Supabase Auth

1 Write the function

supabase/functions/before-user-created/index.ts

import { Webhook } from "https://esm.sh/standardwebhooks@1.0.0";

const hook = new Webhook(
  Deno.env.get("BEFORE_USER_CREATED_HOOK_SECRET")!.replace("v1,whsec_", ""),
);

// Supabase needs application/json on every answer.
const reply = (body: unknown, status = 200) =>
  new Response(JSON.stringify(body), {
    status,
    headers: { "Content-Type": "application/json" },
  });

// HTTP 200 with an error object is what rejects with your message.
const reject = (message: string) =>
  reply({ error: { message, http_code: 422 } });

Deno.serve(async (req) => {
  const payload = await req.text();
  let email = "";
  try {
    const event = hook.verify(payload, Object.fromEntries(req.headers));
    email = (event as { user: { email?: string } }).user.email ?? "";
  } catch {
    return reply({ error: "Bad signature" }, 401);
  }
  if (!email) return reply({}); // phone signups have no address

  try {
    const res = await fetch(
      "https://mailvet.dev/v1/check?email=" + encodeURIComponent(email),
      {
        headers: { Authorization: `Bearer ${Deno.env.get("MAILVET_KEY")}` },
        signal: AbortSignal.timeout(4000),
      },
    );
    if (!res.ok) throw new Error(`HTTP ${res.status}`);
    const check = await res.json();

    if (check.did_you_mean) {
      const local = email.slice(0, email.lastIndexOf("@"));
      return reject(`Did you mean ${local}@${check.did_you_mean}?`);
    }
    if (check.verdict === "invalid") {
      return reject("That address can't receive mail.");
    }
    if (check.verdict === "risky" && check.disposable) {
      return reject("Please use a permanent address, not a throwaway one.");
    }
  } catch (err) {
    console.error("mailvet: no answer", err); // let the signup through
  }
  return reply({});
});

2 Deploy it without JWT checks

supabase functions deploy before-user-created --no-verify-jwt
supabase secrets set MAILVET_KEY=mv_live_your_key

The hook runs before any user exists, so there's no JWT to check. The signature check in the code does that job.

3 Turn on the hook

# Dashboard: Authentication > Hooks > Before User Created > HTTP
# URL: https://<project-ref>.supabase.co/functions/v1/before-user-created
# Generate the secret there, then store it:
supabase secrets set 'BEFORE_USER_CREATED_HOOK_SECRET=v1,whsec_...'