Block fake and disposable signups in Supabase Auth

1. 1. Create the function and its secrets

   Generate the hook secret under Authentication > Hooks > Before User Created (HTTP) in the dashboard. It looks like v1,whsec_....

   supabase functions new before-user-created
   supabase secrets set SIMPLEVERIFIER_KEY=sv_live_... BEFORE_USER_CREATED_HOOK_SECRET='v1,whsec_...'

2. 2. Write the hook

   Deno runs it, so the key comes from Deno.env. Rejections are a 400 with an error object; Supabase passes the message to the client that tried to sign up.

   import { Webhook } from "https://esm.sh/standardwebhooks@1.0.0";
   
   const hookSecret = (Deno.env.get("BEFORE_USER_CREATED_HOOK_SECRET") ?? "").replace("v1,whsec_", "");
   const apiKey = Deno.env.get("SIMPLEVERIFIER_KEY") ?? "";
   const dryRun = Deno.env.get("SIGNUP_GUARD_DRY_RUN") === "1";
   
   function json(body: unknown, status: number) {
     return new Response(JSON.stringify(body), { status, headers: { "Content-Type": "application/json" } });
   }
   
   function blockMessage(reasonCode: string, reason: string): string {
     if (reasonCode === "disposable") return "Please use a permanent email address, not a temporary inbox.";
     const hint = reason.match(/did you mean ([^?\s]+)\??/i)?.[1];
     if (hint) return `Check the spelling of your email address. Did you mean ${hint}?`;
     return "This email address can't receive mail. Please check it.";
   }
   
   Deno.serve(async (req) => {
     const payload = await req.text();
     let email = "";
     try {
       const { user } = new Webhook(hookSecret).verify(payload, Object.fromEntries(req.headers)) as { user: { email?: string } };
       email = user.email ?? "";
     } catch {
       return json({ error: { http_code: 400, message: "Invalid hook signature" } }, 400);
     }
     if (!email || !apiKey) return json({}, 200); // phone signups, or no key set: allow
   
     try {
       const res = await fetch("https://simpleverifier.com/api/v1/verify", {
         method: "POST",
         headers: { Authorization: `Bearer ${apiKey}`, "Content-Type": "application/json" },
         body: JSON.stringify({ email }),
         signal: AbortSignal.timeout(4000), // HTTP hooks must answer within 5 s
       });
       if (!res.ok) return json({}, 200); // fail open
       const result = await res.json();
       if (result.action !== "do_not_send") return json({}, 200); // valid, risky, retry_later: allow
       const message = blockMessage(result.reason_code ?? "", result.reason ?? "");
       if (dryRun) {
         console.log("dry run, would block", result.reason_code);
         return json({}, 200);
       }
       return json({ error: { http_code: 400, message } }, 400);
     } catch {
       return json({}, 200); // timeout: fail open
     }
   });

3. 3. Deploy and switch the hook on

   Hooks run before a JWT exists, so deploy without JWT verification; the signature check above is what keeps strangers out. Then select the function under Authentication > Hooks > Before User Created and save.

   supabase functions deploy before-user-created --no-verify-jwt

4. 4. Flag the warn cases after signup (optional)

   The hook can only allow or reject. To hold free credits for role inboxes, catch-all domains and invented-looking addresses, call the same API from your onboarding code and store reason_code and likely_invented on your profiles table.

More on calling the API from this stack (retries, status handling, tests): API guide. Every field is described in the API docs.