How to Allow Login Only for Invited Users in Supabase

1// Server-side only! (e.g., Edge Function, API route)
2import { createClient } from '@supabase/supabase-js'
3
4const supabaseAdmin = createClient(
5  process.env.SUPABASE_URL!,
6  process.env.SUPABASE_SERVICE_ROLE_KEY!,
7  {
8    auth: {
9      autoRefreshToken: false,
10      persistSession: false,
11    },
12  }
13)

1// Invite a single user
2const { data, error } = await supabaseAdmin.auth.admin.inviteUserByEmail(
3  'newuser@company.com',
4  {
5    data: {
6      full_name: 'Jane Smith',
7      role: 'member',
8    },
9    redirectTo: 'https://your-app.com/welcome',
10  }
11)
12
13if (error) {
14  console.error('Invite failed:', error.message)
15} else {
16  console.log('Invitation sent to:', data.user.email)
17}
18
19// Invite multiple users
20const emails = ['user1@company.com', 'user2@company.com', 'user3@company.com']
21
22for (const email of emails) {
23  const { error } = await supabaseAdmin.auth.admin.inviteUserByEmail(email)
24  if (error) {
25    console.error(`Failed to invite ${email}:`, error.message)
26  }
27}

1// supabase/functions/invite-user/index.ts
2import { createClient } from 'npm:@supabase/supabase-js@2'
3import { corsHeaders } from '../_shared/cors.ts'
4
5Deno.serve(async (req) => {
6  if (req.method === 'OPTIONS') {
7    return new Response('ok', { headers: corsHeaders })
8  }
9
10  // Verify the caller is authenticated
11  const authHeader = req.headers.get('Authorization')
12  if (!authHeader) {
13    return new Response(
14      JSON.stringify({ error: 'Missing authorization header' }),
15      { status: 401, headers: { ...corsHeaders, 'Content-Type': 'application/json' } }
16    )
17  }
18
19  // Create admin client
20  const supabaseAdmin = createClient(
21    Deno.env.get('SUPABASE_URL')!,
22    Deno.env.get('SUPABASE_SERVICE_ROLE_KEY')!
23  )
24
25  // Verify caller is admin
26  const supabaseUser = createClient(
27    Deno.env.get('SUPABASE_URL')!,
28    Deno.env.get('SUPABASE_ANON_KEY')!,
29    { global: { headers: { Authorization: authHeader } } }
30  )
31  const { data: { user } } = await supabaseUser.auth.getUser()
32  if (!user || user.app_metadata?.role !== 'admin') {
33    return new Response(
34      JSON.stringify({ error: 'Admin access required' }),
35      { status: 403, headers: { ...corsHeaders, 'Content-Type': 'application/json' } }
36    )
37  }
38
39  const { email } = await req.json()
40  const { data, error } = await supabaseAdmin.auth.admin.inviteUserByEmail(email)
41
42  if (error) {
43    return new Response(
44      JSON.stringify({ error: error.message }),
45      { status: 400, headers: { ...corsHeaders, 'Content-Type': 'application/json' } }
46    )
47  }
48
49  return new Response(
50    JSON.stringify({ message: `Invitation sent to ${email}` }),
51    { headers: { ...corsHeaders, 'Content-Type': 'application/json' } }
52  )
53})

1<!-- Example invite email template -->
2<h2>You have been invited!</h2>
3<p>You have been invited to join our application.</p>
4<p>Click the link below to accept your invitation and set up your account:</p>
5<p><a href="{{ .ConfirmationURL }}">Accept Invitation</a></p>
6<p>This link expires in 24 hours.</p>
7<p>If you did not expect this invitation, you can ignore this email.</p>