* docs(auth-hooks): clarify webhook status codes and document email_change quirk
- Clarify hook response handling:
- Note that some hooks do not support 204 responses if they require a body
- Update retry-able error behavior for 429/503 with explicit 5s budget
- Add note that Retry-After header is only checked for non-empty value, not parsed
- Expand send-email-hook docs:
- Add detailed section on `email_change` behavior
- Explain secure vs non-secure modes and when two emails must be sent
- Document long-standing quirk where `token_hash` and `token_hash_new`
are swapped relative to expected naming
- Extend enum to include `reauthentication`
- Improve confirmation URL example using URLSearchParams and projectRef
* fix: fix linter error
* fix: pr feedback
* fix: pnpm format
* fix: pr feedback
---------
Co-authored-by: Chris Stockton <chris.stockton@supabase.io>
* feat: add documentation and UI integration for Before User Created hook
- Added new guide: `before-user-created-hook.mdx`, documenting usage, inputs,
outputs, and multiple complete examples for HTTP and SQL.
- Updated navigation menu and hook index table to include the new hook.
- Hook is now listed as available on Free and Pro plans.
Studio changes:
- Registered `Before User Created` hook in `hooks.constants.ts` with proper
title, slug, and configuration keys.
- Enabled Docs button linking to hook guide in both `CreateHookSheet` and `HookCard` components.
- Extended hook listing page to support docs access via `secondaryActions`.
This hook allows developers to intercept and reject user creation across all
flows (email/password, OAuth, SSO, SAML, anonymous) - enabling custom signup
logic like domain allowlists, geofencing, or account gating.
* fix: add subnet to mdx lint allowed list
* fix: incorporate feedback and spelling changes
* feat: add allow/deny domain and CIDR examples to before-user-created hook
This commit enhances the documentation for the before-user-created auth hook:
- Adds production-ready SQL examples for blocking or allowing signups by email domain (signup_email_domains) and IP address or CIDR (signup_networks)
- Introduces enum-based classification (allow vs deny) for both domain and network restrictions
- Adds full migration-style snippets for easy copy/paste into Supabase SQL Editor
- Includes updated HTTP examples that delegate to Postgres functions via Supabase client rpc()
- Adds environment setup guidance and edge function scaffolding
* fix: pnpm format
---------
Co-authored-by: Chris Stockton <chris.stockton@supabase.io>
* fix: revoke role on public for hooks
* fix: update SQL editor queries
* fix: update examples
* fix: update RBAC doc
* fix: update description to describe why we revoke public
* fix: correct use of we
* fix: run prettier
* fix: remove unintentionally added files
Begin the process of moving our MDX files into their own content directory.
Fixed a few minor bugs re: ToC and tabs not rerendering consistently on page navigation. (The ToC thing wasn't a problem before the refactor, the tabs thing is a problem on prod.)
Moved MDX files can't import their own components, so everything they require needs to be back in the component prop for mdx-remote's serializer. Cleaned this up a bit and lazy-loaded heavy/rare stuff. Also, the component prop doesn't take arbitrary objects (only actual components), so imported data has to be wrapped in a component.
