How to Allow Sign In Only with Specific Domains in Supabase

1-- Create the allowed domains table
2CREATE TABLE public.allowed_email_domains (
3  id bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
4  domain text NOT NULL UNIQUE,
5  created_at timestamptz DEFAULT now()
6);
7
8-- Enable RLS
9ALTER TABLE public.allowed_email_domains ENABLE ROW LEVEL SECURITY;
10
11-- Only admins can manage domains (no public access)
12CREATE POLICY "Only admins can manage allowed domains"
13  ON public.allowed_email_domains
14  FOR ALL
15  TO authenticated
16  USING (
17    (SELECT auth.jwt() -> 'app_metadata' ->> 'role') = 'admin'
18  );
19
20-- Insert your allowed domains
21INSERT INTO public.allowed_email_domains (domain) VALUES
22  ('yourcompany.com'),
23  ('partnerfirm.org');

1CREATE OR REPLACE FUNCTION public.check_email_domain()
2RETURNS trigger
3LANGUAGE plpgsql
4SECURITY DEFINER SET search_path = ''
5AS $$
6DECLARE
7  user_domain text;
8BEGIN
9  -- Extract domain from email (lowercase for case-insensitive comparison)
10  user_domain := lower(split_part(NEW.email, '@', 2));
11
12  -- Check if domain is in the allowlist
13  IF NOT EXISTS (
14    SELECT 1 FROM public.allowed_email_domains
15    WHERE domain = user_domain
16  ) THEN
17    RAISE EXCEPTION 'Signups from the domain % are not allowed.', user_domain;
18  END IF;
19
20  RETURN NEW;
21END;
22$$;

1CREATE TRIGGER check_email_domain_on_signup
2  BEFORE INSERT ON auth.users
3  FOR EACH ROW
4  EXECUTE FUNCTION public.check_email_domain();

1import { createClient } from '@supabase/supabase-js'
2
3const supabase = createClient(
4  process.env.NEXT_PUBLIC_SUPABASE_URL!,
5  process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!
6)
7
8const ALLOWED_DOMAINS = ['yourcompany.com', 'partnerfirm.org']
9
10function isAllowedDomain(email: string): boolean {
11  const domain = email.split('@')[1]?.toLowerCase()
12  return ALLOWED_DOMAINS.includes(domain)
13}
14
15async function signUp(email: string, password: string) {
16  // Client-side check for instant feedback
17  if (!isAllowedDomain(email)) {
18    return { error: 'Only yourcompany.com and partnerfirm.org emails are allowed.' }
19  }
20
21  // Server-side trigger provides the real enforcement
22  const { data, error } = await supabase.auth.signUp({
23    email,
24    password,
25  })
26
27  if (error) {
28    return { error: error.message }
29  }
30
31  return { data }
32}

1// Test with allowed domain — should succeed
2const { data, error } = await supabase.auth.signUp({
3  email: 'user@yourcompany.com',
4  password: 'secure-password-123',
5})
6console.log('Allowed domain:', data, error)
7// Expected: data.user exists, error is null
8
9// Test with disallowed domain — should fail
10const { data: data2, error: error2 } = await supabase.auth.signUp({
11  email: 'user@gmail.com',
12  password: 'secure-password-123',
13})
14console.log('Disallowed domain:', data2, error2)
15// Expected: error.message contains 'Signups from the domain gmail.com are not allowed.'