Supabase integration
Refuse disposable emails and repeat signups in Supabase Auth
Supabase calls its Before User Created hook just before it creates a user. Give that hook your SignupBouncer hook URL, and we check each signup and refuse the ones marked block. You paste a URL and a secret into Supabase and change no code in your app.
- Create a free account. Your app's Integration tab shows its hook URL and hook secret.
- In Supabase, add a Before User Created hook of the HTTPS type, and paste in the hook URL and the hook secret.
- Sign up to your app with a test address, and find the signup on the Checks tab. Watch your signups in shadow mode, then switch the app to enforce.
What SignupBouncer refuses
Supabase sends us every signup it's about to create: email and password, magic link, phone, and OAuth providers such as Google and GitHub. In enforce mode, we refuse a signup marked block. On every plan, the email checks look for:
- a disposable email domain, or a new domain whose mail goes to a known burner mail server
- a domain that can't receive email
- the same inbox signing up again under another spelling, such as Gmail dots or a
+tag. Each repeat within 7 days adds points.
On the Starter plan and up, the signup's IP adds points when it comes from a datacenter, a VPN, Tor or a hijacked network. On the Free plan, we run the IP checks too, and your log lists what they found.
When Supabase marks an OAuth or SSO signup as email-verified, we check its IP and signup bursts only. The provider has already confirmed that the person owns the address.
If you use email_guard
email_guard is a free Postgres function that also runs as a Before User Created hook. It refuses domains on the open disposable-email-domains list, and a second signup from the same Gmail inbox. The domains in your database change only when you upgrade email_guard to a newer version.
We rebuild our list of disposable domains every hour, and we also look up the mail server behind each new domain. We count repeat inboxes at Proton, Yandex, Yahoo and Fastmail as well as Gmail. In shadow mode, you see what we'd refuse before we refuse anything.
Full setup in the docs
For the full setup, read the Supabase hook page in our docs. You can install the hook in the Supabase dashboard or with the Supabase CLI, and turn it off again in the same place.
More
- Supabase in our docs, next to the REST API and the reason codes.
- Supabase's guide to the Before User Created hook.
Start on the Free plan
1 app and 1,000 checks a month. No card. Shadow mode logs what we would refuse until you switch the app to enforce.