Send Supabase Auth emails through Mailtruss.

1// Supabase Edge Function for Auth > Hooks > Send Email.
2// In Deno, import from "npm:mailtruss" and "npm:standardwebhooks".
3import { Webhook } from "standardwebhooks";
4import { MailClient } from "mailtruss";
5​
6const mail = new MailClient({ apiKey: process.env.MAILTRUSS_API_KEY! });
7// Supabase shows the secret as "v1,whsec_<base64>"; the library wants only the base64 part.
8const hook = new Webhook(process.env.SEND_EMAIL_HOOK_SECRET!.replace("v1,whsec_", ""));
9​
10const SUBJECTS: Record<string, string> = {
11  signup: "Confirm your email",
12  recovery: "Reset your password",
13  magiclink: "Your sign-in link",
14  email_change: "Confirm your new email",
15  invite: "You have been invited",
16};
17​
18type HookPayload = {
19  user: { email: string };
20  email_data: { token_hash: string; email_action_type: string; redirect_to: string };
21};
22​
23export async function handler(req: Request): Promise<Response> {
24  if (req.method !== "POST") return new Response("not allowed", { status: 405 });
25  let payload: HookPayload;
26  try {
27    payload = hook.verify(await req.text(), Object.fromEntries(req.headers)) as HookPayload;
28  } catch {
29    return new Response("invalid signature", { status: 401 });
30  }
31  const { user, email_data } = payload;
32  const verify = new URLSearchParams({
33    token: email_data.token_hash,
34    type: email_data.email_action_type,
35    redirect_to: email_data.redirect_to,
36  });
37  const link = `https://${process.env.SUPABASE_PROJECT_REF}.supabase.co/auth/v1/verify?${verify}`;
38  try {
39    await mail.emails.send(
40      {
41        from: "Acme <auth@yourdomain.com>",
42        to: user.email,
43        subject: SUBJECTS[email_data.email_action_type] ?? "Action required",
44        html: `<p><a href="${link}">Continue</a></p>`,
45        text: `Continue: ${link}`,
46        tracking: false, // never rewrite auth links through a click tracker
47      },
48      { idempotencyKey: `auth:${email_data.token_hash}` },
49    );
50  } catch (e) {
51    const body = JSON.stringify({ error: { http_code: 500, message: String(e) } });
52    return new Response(body, { status: 500, headers: { "content-type": "application/json" } });
53  }
54  return new Response("{}", { status: 200, headers: { "content-type": "application/json" } });
55}