Validate emails before Supabase inserts

Guard the insert, not just the form

Supabase makes it trivial to write a row, which is exactly why bad email data ends up in the table. Client-side validation only checks the shape of an address; it cannot tell you whether the mailbox exists. If you want your users and leads tables to hold real, reachable addresses, the check has to sit on the server side of the insert.

A Supabase Edge Function is the natural place for it. It runs on Deno, reads secrets from Deno.env, and can call Verifly before it ever touches the database. The pattern is: the client posts the email to the function, the function verifies it, and only on a deliverable verdict does it perform the insert with the service-role client. Disposable and invalid addresses are turned away before a row exists.

Store the verdict alongside the record — a verification_status column, or a JSON field in user metadata — so downstream jobs can trust the data without re-checking. Set the Verifly key as a function secret with supabase secrets set; it never belongs in client code or the database.

An Edge Function that verifies then inserts

1. Set the secret: supabase secrets set VERIFLY_API_KEY=vf_your_api_key (get the key at verifly.email/api/v1/autonomous/register).
2. In the Edge Function, read the posted email and call GET /verify with the key from Deno.env.
3. If the verdict is not deliverable (or the address is disposable), return a 4xx and do not insert.
4. On a clean verdict, insert the row with the service-role client and persist verification_status.
5. For CSV imports, call POST /verify/batch from the function instead of one request per address.

import { createClient } from 'https://esm.sh/@supabase/supabase-js@2'

Deno.serve(async (req) => {
  const { email } = await req.json()
  const v = await fetch(
    `https://verifly.email/api/v1/verify?email=${encodeURIComponent(email)}`,
    { headers: { Authorization: `Bearer ${Deno.env.get('VERIFLY_API_KEY')}` } }
  ).then(r => r.json())

  if (v.result !== 'deliverable' || v.disposable) {
    return new Response(JSON.stringify({ error: 'invalid email' }), { status: 422 })
  }

  const db = createClient(Deno.env.get('SUPABASE_URL')!, Deno.env.get('SUPABASE_SERVICE_ROLE_KEY')!)
  await db.from('leads').insert({ email, verification_status: v.result })
  return new Response(JSON.stringify({ ok: true }))
})