Block disposable emails in Supabase Auth with a free hook (no API key)

// Supabase Auth "before user created" hook: refuse throwaway email addresses with FFraud's free API.
// No key and no imports. Deploy with --no-verify-jwt; the Standard Webhooks signature protects the hook.
const API_URL = "https://api.ffraud.com/public/email/check";
// Relay services such as Apple's Hide My Email forward to an inbox a real person reads. Set to false to refuse them too.
const ACCEPT_RELAYS = true;
const MESSAGE = "Please use an email address you will keep. Throwaway inboxes are not accepted.";

const bytes = (base64: string) => Uint8Array.from(atob(base64), (c) => c.charCodeAt(0));
const json = (status: number, body: unknown) =>
  new Response(JSON.stringify(body), { status, headers: { "Content-Type": "application/json" } });

// Standard Webhooks: HMAC-SHA256 over "id.timestamp.body", and a timestamp within 5 minutes.
async function signed(req: Request, body: string): Promise<boolean> {
  const id = req.headers.get("webhook-id");
  const timestamp = req.headers.get("webhook-timestamp");
  const signatures = req.headers.get("webhook-signature");
  const secret = Deno.env.get("BEFORE_USER_CREATED_HOOK_SECRET")?.replace("v1,whsec_", "");
  if (!id || !timestamp || !signatures || !secret) return false;
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false;
  try {
    const key = await crypto.subtle.importKey("raw", bytes(secret), { name: "HMAC", hash: "SHA-256" }, false, ["verify"]);
    const data = new TextEncoder().encode(`${id}.${timestamp}.${body}`);
    for (const signature of signatures.split(" ")) {
      const [version, value] = signature.split(",");
      if (version === "v1" && value && (await crypto.subtle.verify("HMAC", key, bytes(value), data))) return true;
    }
  } catch {
    // a secret or a signature that is not base64
  }
  return false;
}

// "temp", "alias" or "normal" for the domain, or null when the API cannot answer in 2 seconds.
// The type depends on the domain alone, so the API gets user@ and the domain, never the address.
async function emailType(domain: string): Promise<string | null> {
  try {
    const res = await fetch(API_URL, {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ email: `user@${domain}` }),
      signal: AbortSignal.timeout(2000),
    });
    if (!res.ok) return null;
    const type = (await res.json()).email_type;
    return typeof type === "string" ? type : null;
  } catch {
    return null;
  }
}

export async function handler(req: Request): Promise<Response> {
  const body = await req.text();
  if (!(await signed(req, body))) return json(401, { error: { http_code: 401, message: "Invalid hook signature" } });
  const email = String(JSON.parse(body).user?.email ?? "").trim().toLowerCase();
  const at = email.lastIndexOf("@");
  if (at < 1) return json(200, {}); // a phone signup has no email address
  const type = await emailType(email.slice(at + 1));
  if (type === "temp" || (type === "alias" && !ACCEPT_RELAYS)) {
    // Answer 200: Supabase Auth reads the error object only from a 200 or 202, and turns a 400 into a 500.
    return json(200, { error: { http_code: 400, message: MESSAGE } });
  }
  return json(200, {}); // a normal address, a relay, or no answer from the API: the signup goes on
}

Deno.serve(handler);

# .env
BEFORE_USER_CREATED_HOOK_SECRET="v1,whsec_<the secret from the Auth Hooks page>"

supabase secrets set --env-file .env
supabase functions deploy before-user-created-hook --no-verify-jwt

-- Throwaway email domains for the before-user-created hook, loaded from FFraud's MIT list.
create table if not exists public.disposable_email_domains (domain text primary key);
alter table public.disposable_email_domains enable row level security;

create or replace function public.hook_block_disposable_email(event jsonb)
returns jsonb
language plpgsql
stable
as $$
declare
  email text := lower(trim(coalesce(event->'user'->>'email', '')));
  labels text[] := string_to_array(substring(email from '[^@]*$'), '.');
begin
  -- No address (a phone signup), or Sign in with Apple, whose relay addresses a real person reads.
  if position('@' in email) = 0 or event->'user'->'app_metadata'->>'provider' = 'apple' then
    return '{}'::jsonb;
  end if;
  -- The domain or any parent of it: inbox.mailinator.com matches mailinator.com.
  for i in 1 .. coalesce(array_length(labels, 1), 0) - 1 loop
    if exists (select 1 from public.disposable_email_domains d where d.domain = array_to_string(labels[i:], '.')) then
      return jsonb_build_object('error', jsonb_build_object(
        'http_code', 400,
        'message', 'Please use an email address you will keep. Throwaway inboxes are not accepted.'));
    end if;
  end loop;
  return '{}'::jsonb;
end;
$$;

-- Supabase Auth calls the hook as supabase_auth_admin; nobody else may run it.
grant usage on schema public to supabase_auth_admin;
grant select on public.disposable_email_domains to supabase_auth_admin;
drop policy if exists "Auth reads the disposable list" on public.disposable_email_domains;
create policy "Auth reads the disposable list" on public.disposable_email_domains
  for select to supabase_auth_admin using (true);
grant execute on function public.hook_block_disposable_email to supabase_auth_admin;
revoke execute on function public.hook_block_disposable_email from authenticated, anon, public;

#!/bin/sh
# Refresh public.disposable_email_domains from FFraud's MIT list. Run it once a day from cron or CI.
# DATABASE_URL is your project's connection string (Supabase dashboard, Connect).
set -eu
cd "$(mktemp -d)"
curl -fsSL --max-time 60 -o disposable-email-domains.txt \
  https://raw.githubusercontent.com/FFraud-com/disposable-email-domains/main/disposable-email-domains.txt
psql "$DATABASE_URL" -v ON_ERROR_STOP=1 <<'SQL'
begin;
create temp table incoming (domain text) on commit drop;
\copy incoming from 'disposable-email-domains.txt'
delete from incoming where domain is null or trim(domain) = '' or domain like '#%';
do $$ begin
  if (select count(*) from incoming) < 100000 then
    raise exception 'only % domains in the download, keeping the current list', (select count(*) from incoming);
  end if;
end $$;
delete from public.disposable_email_domains;
insert into public.disposable_email_domains (domain)
  select distinct lower(rtrim(trim(domain), '.')) from incoming;
commit;
SQL

Node v22.19.0 2026-10-26T01:03:31.423Z | Deno.serve got the handler: true
test@mailinator.com                            -> 200 {"error":{"http_code":400,"message":"Please use an email address you will keep. Throwaway inboxes are not accepted."}}
                                                  Auth: signup refused: 400 "Please use an email address you will keep. Throwaway inboxes are not accepted."; 661 ms, API calls: 1
user@inbox.mailinator.com                      -> 200 {"error":{"http_code":400,"message":"Please use an email address you will keep. Throwaway inboxes are not accepted."}}
                                                  Auth: signup refused: 400 "Please use an email address you will keep. Throwaway inboxes are not accepted."; 262 ms, API calls: 1
test@privaterelay.appleid.com (Sign in with Apple) -> 200 {}
                                                  Auth: signup goes on; 164 ms, API calls: 1
Team@FFraud.com                                -> 200 {}
                                                  Auth: signup goes on; 256 ms, API calls: 1
phone signup, no email                         -> 200 {}
                                                  Auth: signup goes on; 0 ms, API calls: 0
two signatures, after a secret rotation        -> 200 {}
                                                  Auth: signup goes on; 219 ms, API calls: 1
wrong signature                                -> 401 {"error":{"http_code":401,"message":"Invalid hook signature"}}
                                                  Auth: 500 "Hook requires authorization token"; 0 ms, API calls: 0
signed 10 minutes ago                          -> 401 {"error":{"http_code":401,"message":"Invalid hook signature"}}
                                                  Auth: 500 "Hook requires authorization token"; 0 ms, API calls: 0
for comparison: a 400 answer, as in the docs   -> 400 {"error":{"http_code":400,"message":"Please sign up with a company email address."}}
                                                  Auth: 500 "Invalid payload sent to hook"; 0 ms, API calls: 0
what the API received: {"email":"user@mailinator.com"} {"email":"user@inbox.mailinator.com"} {"email":"user@privaterelay.appleid.com"} {"email":"user@ffraud.com"} {"email":"user@ffraud.com"}
API down, test@mailinator.com                  -> 200 {}
                                                  Auth: signup goes on; 0 ms, API calls: 1
ACCEPT_RELAYS false, test@privaterelay.appleid.com -> 200 {"error":{"http_code":400,"message":"Please use an email address you will keep. Throwaway inboxes are not accepted."}}
                                                  Auth: signup refused: 400 "Please use an email address you will keep. Throwaway inboxes are not accepted."; 166 ms, API calls: 1
hook time with one API call, 12 runs: median 197 ms, fastest 124 ms, slowest 464 ms

postgres (PostgreSQL) 17.6, 2026-10-26T01:01:18Z
psql:project/supabase/migrations/20261026000000_block_disposable_email.sql:33: NOTICE:  policy "Auth reads the disposable list" for relation "public.disposable_email_domains" does not exist, skipping
migration applied
BEGIN
CREATE TABLE
COPY 224174
DELETE 0
DO
DELETE 0
INSERT 0 224174
COMMIT
refresh: 224174 domains in 1721 ms, table and index 20 MB
guard: only 2000 domains in the download, keeping the current list
after the short download: 224174 domains
hook("test@mailinator.com", provider email) as supabase_auth_admin -> {"error": {"message": "Please use an email address you will keep. Throwaway inboxes are not accepted.", "http_code": 400}}
hook("user@inbox.mailinator.com", provider email) as supabase_auth_admin -> {"error": {"message": "Please use an email address you will keep. Throwaway inboxes are not accepted.", "http_code": 400}}
hook("Team@FFraud.com", provider email) as supabase_auth_admin -> {}
hook("test@privaterelay.appleid.com", provider apple) as supabase_auth_admin -> {}
hook("test@privaterelay.appleid.com", provider email) as supabase_auth_admin -> {"error": {"message": "Please use an email address you will keep. Throwaway inboxes are not accepted.", "http_code": 400}}
hook("test@duck.com", provider email) as supabase_auth_admin -> {"error": {"message": "Please use an email address you will keep. Throwaway inboxes are not accepted.", "http_code": 400}}
hook("", provider phone) as supabase_auth_admin -> {}
anon calls the hook -> permission denied for function hook_block_disposable_email
anon reads the table -> permission denied for table disposable_email_domains
hook on a listed domain: 10.6 microseconds a call (10000 calls)
hook on an unlisted subdomain (3 lookups): 15.2 microseconds a call (10000 calls)
plan: Index Only Scan using disposable_email_domains_pkey on disposable_email_domains (actual rows=1 loops=1)   Index Cond: (domain = 'mailinator.com'::text)   Heap Fetches: 1