How to block disposable emails in Supabase Auth

Quick answer

Add an HTTP Before User Created hook (an Edge Function). For every new signup, call a disposable-email check; if the verdict is “block”, return a 400 with an error object and Supabase stops the signup. If the check times out, return {} and let the user in.

Why a hook and not just the form

A check in your signup form is good UX, but bots can call the Supabase Auth API directly and skip your form. The hook runs inside Supabase’s signup flow, so it covers email, magic link and OAuth signups however they arrive.

1. Create the Edge Function

The hook payload carries the new user in user, with the address in user.email. Supabase signs HTTP hooks with Standard Webhooks, so verify the signature first:

// supabase/functions/before-user-created-hook/index.ts
import { Webhook } from 'https://esm.sh/standardwebhooks@1.0.0'

const reject = (message: string) =>
  new Response(JSON.stringify({ error: { http_code: 400, message } }), {
    status: 400,
    headers: { 'Content-Type': 'application/json' },
  })
const allow = () =>
  new Response('{}', { status: 200, headers: { 'Content-Type': 'application/json' } })

Deno.serve(async (req) => {
  const payload = await req.text()
  const secret = Deno.env.get('BEFORE_USER_CREATED_HOOK_SECRET')!.replace('v1,whsec_', '')

  let user
  try {
    ;({ user } = new Webhook(secret).verify(payload, Object.fromEntries(req.headers)) as any)
  } catch {
    return reject('Invalid request')
  }

  const email = user.email || ''
  if (!email) return allow() // phone signups

  try {
    const res = await fetch('https://usevetto.com/v1/check', {
      method: 'POST',
      headers: {
        Authorization: `Bearer ${Deno.env.get('VETTO_SECRET_KEY')}`,
        'Content-Type': 'application/json',
      },
      body: JSON.stringify({ email }),
      signal: AbortSignal.timeout(2500), // the hook has 5 s in total
    })
    const v = await res.json()
    if (v.verdict === 'block') return reject(v.message || 'Please use a real email address.')
  } catch {
    // Timeout or network error: fail open, never lock real people out.
  }
  return allow()
})

2. Set the secrets and deploy

# .env (never commit it)
BEFORE_USER_CREATED_HOOK_SECRET="v1,whsec_..."   # from Authentication → Hooks
VETTO_SECRET_KEY="sk_..."                         # from your Vetto dashboard

supabase secrets set --env-file .env
supabase functions deploy before-user-created-hook --no-verify-jwt

3. Turn the hook on

1. Supabase Dashboard → Authentication → Hooks → Before User Created.
2. Choose HTTP, paste your function URL and generate the secret (that is the value for BEFORE_USER_CREATED_HOOK_SECRET).
3. Sign up with a throwaway address like x7@mailinator.com: you should get the error. A normal Gmail or Outlook address goes through.

What the check catches

• Throwaway inboxes (mailinator.com, yopmail.com and 9,000+ more), plus domains that live on known throwaway mail servers.
• Dead domains with no mail server, which can never receive your confirmation email.
• Repeat signups from the same Gmail inbox through dots, +tags or googlemail.com (returned as a repeat count you can act on).
• Privacy relays like Apple Hide My Email and DuckDuckGo are allowed: they reach a real person.

Not using a hook? Check from your own API

If you create users from your own backend with auth.admin.createUser or a server action, call the same /v1/check endpoint there before creating the user. For scripted traffic, add Supabase captcha as well. To see how many of your existing users are junk, export them and run the free email list audit.

Related: Firebase · Auth.js / NextAuth · how to detect fake signups · free trial abuse.