NextAuth / Auth.js

1 Keep the key on the server

MAILVET_KEY=mv_live_your_key

Set it wherever your server reads its environment. Never put it in client code.

2 Put the check in one place

lib/mailvet.ts

// The fields this code reads. The response has more: mailvet.dev/docs
export type Check = {
  verdict: "valid" | "risky" | "invalid";
  disposable: boolean;
  did_you_mean: string;
};

// null means no answer: MailVet is down or slow, the quota is
// used up, or the key is wrong. Callers let the signup through.
export async function checkEmail(email: string): Promise<Check | null> {
  try {
    const res = await fetch(
      "https://mailvet.dev/v1/check?email=" + encodeURIComponent(email),
      {
        headers: { Authorization: `Bearer ${process.env.MAILVET_KEY}` },
        signal: AbortSignal.timeout(5000),
      },
    );
    if (!res.ok) {
      console.error(`mailvet: HTTP ${res.status}`);
      return null;
    }
    return (await res.json()) as Check;
  } catch (err) {
    console.error("mailvet: no answer", err);
    return null;
  }
}

3 Add the signIn callback

auth.ts

import { PrismaAdapter } from "@auth/prisma-adapter";
import NextAuth from "next-auth";
import GitHub from "next-auth/providers/github";
import { checkEmail } from "@/lib/mailvet";
import { prisma } from "@/lib/prisma";

export const { handlers, signIn, signOut, auth } = NextAuth({
  adapter: PrismaAdapter(prisma),
  providers: [GitHub],
  callbacks: {
    async signIn({ user, account, email }) {
      // Magic links call this twice. Check at the request, not the click.
      if (account?.type === "email" && !email?.verificationRequest) return true;
      if (!user.email) return true;

      // Returning user: no check spent, and no lockout if their
      // domain gets listed later. Swap this for your own user lookup.
      const known = await prisma.user.findUnique({
        where: { email: user.email },
      });
      if (known) return true;

      const check = await checkEmail(user.email);
      if (check?.did_you_mean || check?.verdict === "invalid") {
        return "/signup?error=email";
      }
      if (check?.verdict === "risky" && check?.disposable) return "/signup?error=disposable";
      return true;
    },
  },
});