If your product uses Supabase Auth, Barua can send its one-time codes from your sender. Supabase still creates and checks every code. Barua delivers it through your workspace's own sending lane, with the same bounce and complaint handling as your other email.
Barua sends codes only. Your app verifies them with Supabase verifyOtp.
Emails with a sign-in or reset link are not supported. Email address changes
and Supabase's account notification emails are not supported either.
Before you start
Your sender must be active and verified. See
Check sending health. Turning this on needs
a connection with launch:write, and the workspace owner approves it.
Turn it on
Read the current state, including generation, with the
installed helpers:
node "$BARUA_SKILL/scripts/manage.mjs" auth-email
Then request auth-email.enable through manage.mjs action, with that
generation as expectedGeneration (a string, "0" the first time), a stable
idempotency key and a new --secret-file. After the owner approves, wait --id <operation> with the same secret file
saves the hook secret. The result's hookUrl is the address for Supabase.
Exact inputs are in the
management reference.
In your Supabase project, turn on the Send Email hook with that URL and secret. Supabase applies its hourly email rate limit before calling the hook, so raise that limit to your expected sign-in volume.
Send yourself a code and check that it arrives from your sender.
What Barua checks
Each code goes only to the address Supabase names. A retried hook call never sends a second copy. An address that hard-bounced or sent a spam complaint gets no more codes, and erased addresses get none. Each workspace can send 200 codes an hour, and each address 10.
Three spam complaints or 20 hard bounces on sign-in codes within 24 hours turn
sign-in email off. auth-email then shows the reason. Pausing sending does
not stop sign-in codes.
Turning it on again issues a new hook URL and secret, and the old ones stop working. Update Supabase with both.
Turn it off
Turn the hook off in Supabase first, so Supabase's own sender takes over.
Then request auth-email.disable. If you disable it in Barua first, nobody
can get a sign-in code until the hook is off.