# Send your app's sign-in codes

If your product uses Supabase Auth, Barua can send its one-time codes from
your sender. Supabase still creates and checks every code. Barua delivers it
through your workspace's own sending lane, with the same bounce and complaint
handling as your other email.

Barua sends codes only. Your app verifies them with Supabase `verifyOtp`.
Emails with a sign-in or reset link are not supported. Email address changes
and Supabase's account notification emails are not supported either.

## Before you start

Your sender must be active and verified. See
[Check sending health](/docs/guides/deliverability.md). Turning this on needs
a connection with `launch:write`, and the workspace owner approves it.

## Turn it on

Read the current state, including `generation`, with the
[installed helpers](/docs/guides/quickstart.md):

```sh
node "$BARUA_SKILL/scripts/manage.mjs" auth-email
```

Then request `auth-email.enable` through `manage.mjs action`, with that
generation as `expectedGeneration` (a string, `"0"` the first time), a stable
idempotency key and a new `--secret-file`. After the owner approves, `wait --id <operation>` with the same secret file
saves the hook secret. The result's `hookUrl` is the address for Supabase.
Exact inputs are in the
[management reference](/skills/barua-setup/references/management.md#workspace-sign-in-emails).

In your Supabase project, turn on the Send Email hook with that URL and
secret. Supabase applies its hourly email rate limit before calling the
hook, so raise that limit to your expected sign-in volume.

Send yourself a code and check that it arrives from your sender.

## What Barua checks

Each code goes only to the address Supabase names. A retried hook call never
sends a second copy. An address that hard-bounced or sent a spam complaint gets
no more codes, and erased addresses get none. Each workspace can send 200 codes
an hour, and each address 10.

Three spam complaints or 20 hard bounces on sign-in codes within 24 hours turn
sign-in email off. `auth-email` then shows the reason. Pausing sending does
not stop sign-in codes.

Turning it on again issues a new hook URL and secret, and the old ones stop
working. Update Supabase with both.

## Turn it off

Turn the hook off in Supabase first, so Supabase's own sender takes over.
Then request `auth-email.disable`. If you disable it in Barua first, nobody
can get a sign-in code until the hook is off.