Can signInWithOtp lead to user_recovery_requested?

Hi! I have a general question regarding the signup/in flow of supabase, as I have experienced some things that I cannot fully understand using the docs.

My current situation is:
- I create users programmatically using an edge function

const { data: created, error: createErr } = await supabase.auth.admin.createUser({
    email,
    password: generatedPassword,
    user_metadata: { first_name: first, last_name: last, name },
    email_confirm: true
  })

const { data: created, error: createErr } = await supabase.auth.admin.createUser({
    email,
    password: generatedPassword,
    user_metadata: { first_name: first, last_name: last, name },
    email_confirm: true
  })

(Note: I tried both with/without password and with/without email_confirm, password makes no difference (I don't use it, only magic links), and not adding email_confirm does not work as actually confirming seems to be the last part of the signup flow and I want to keep signups blocked, that said I currently have signup enabled again for this instance for testing)

- After that, users should be able to sign in with the client-side call of

createClient().auth.signInWithOtp({
      email,
      options: {
        shouldCreateUser: false
      }
    });

createClient().auth.signInWithOtp({
      email,
      options: {
        shouldCreateUser: false
      }
    });

but for the programmatically generated user, I get "Email Address is Invalid" with the action being "user_recovery_requested".

Some settings:
- Confirm email: disabled
- Allow new users to sign up: currently enabled (but should be disabled)
- Email (Provider): enabled

Signup works, "Confirmed at" is not null, "Invited at",
"Confirmation sent at" and "Last signed in" are null.

I am unsure why "user_recovery_requested" is triggered by signInWithOtp in the first place and why I get the invalid email error message, maybe some of you understand the inner workings of supabase good enough to tell me :)

Thanks for your time!

Can signInWithOtp lead to user_recovery_requested?

const { data: created, error: createErr } = await supabase.auth.admin.createUser({
    email,
    password: generatedPassword,
    user_metadata: { first_name: first, last_name: last, name },
    email_confirm: true
  })

const { data: created, error: createErr } = await supabase.auth.admin.createUser({
    email,
    password: generatedPassword,
    user_metadata: { first_name: first, last_name: last, name },
    email_confirm: true
  })

createClient().auth.signInWithOtp({
      email,
      options: {
        shouldCreateUser: false
      }
    });

createClient().auth.signInWithOtp({
      email,
      options: {
        shouldCreateUser: false
      }
    });

Can signInWithOtp lead to user_recovery_requested?

Can signInWithOtp lead to user_recovery_requested?

Similar Threads

Similar Threads

Similar Threads