Email Links And Verification

Handlet uses Supabase Auth email links for account verification and recovery flows where configured.

Callback handling

Email links return to the app callback route. The callback exchanges the token for a session, then redirects based on account state.

Local testing

Local Supabase exposes a local email testing inbox when Supabase is running. Use that inbox to test confirmation and recovery links without sending real email.

Operational notes

• Keep link expiry aligned with security expectations.
• Avoid logging full callback URLs or tokens.
• Confirm that NEXT_PUBLIC_SITE_URL matches the environment being tested.
• Use the app mailer separately for product emails such as team invitations.