RDS Supabase SMS Authentication Configuration (SMS Webhook + Alibaba Cloud SMS Provider)

Step 1: Create and deploy the SMS-sending function

This step creates an HTTP-triggered function that acts as RDS Supabase's SMS Webhook.

1. Prepare the function code. Create a project folder with the following standard structure: package.json (lists dependencies), tsconfig.json (TypeScript configuration), .env (environment variables), and the core logic file src/server.ts. You can download the full project from the attached archive code.zip.

   The core logic is in src/server.ts. This file receives webhook requests from Supabase, validates an optional key, and calls the Alibaba Cloud SMS API.

   server.ts

   import express, { Request, Response } from 'express';
   import dotenv from 'dotenv';
   import { Webhook } from 'standardwebhooks';
   dotenv.config();
   
   // Alibaba Cloud SDK
   import Dypnsapi20170525, { SendSmsVerifyCodeRequest } from '@alicloud/dypnsapi20170525';
   import { Config as OpenApiConfig } from '@alicloud/openapi-client';
   import * as Util from '@alicloud/tea-util';
   
   
   const app = express();
   app.use(express.json());
   
   // Read config from environment variables
   const ACCESS_KEY_ID = process.env.ALICLOUD_ACCESS_KEY_ID!;
   const ACCESS_KEY_SECRET = process.env.ALICLOUD_ACCESS_KEY_SECRET!;
   const REGION_ID = process.env.REGION_ID || 'ap-southeast-1';
   const SIGN_NAME = process.env.SIGN_NAME!;
   const TEMPLATE_CODE = process.env.TEMPLATE_CODE!;
   const PORT = parseInt(process.env.PORT || '3000');
   const SMS_HOOK_SECRET = process.env.SMS_HOOK_SECRET;
   
   // Create DYPNS client
   function createClient(): Dypnsapi20170525 {
     const config = new OpenApiConfig({
       accessKeyId: ACCESS_KEY_ID,
       accessKeySecret: ACCESS_KEY_SECRET,
       regionId: REGION_ID,
       endpoint: 'dypnsapi.aliyuncs.com',
       protocol: 'https'
     });
     return new Dypnsapi20170525(config);
   }
   
   const client = createClient();
   /**
    * Verify Supabase webhook request
    * @param req - Express request object
    * @throws Error if verification fails
    */
   export function verifySupabaseWebhook(req: Request): void {
     const SMS_HOOK_SECRET = process.env.SMS_HOOK_SECRET;
     
     // Skip verification if SMS_HOOK_SECRET is not set
     if (!SMS_HOOK_SECRET) {
       console.warn('SMS_HOOK_SECRET not configured, skipping webhook verification');
       return;
     }
     
     try {
       // Use standardwebhooks library to verify
       const secret = SMS_HOOK_SECRET.replace('v1,whsec_', '');
       const wh = new Webhook(secret);
       
       // Get raw request body
       const payload = JSON.stringify(req.body);
       
       // Use req.headers directly (Express.js gives key-value pairs)
       const headers = req.headers as Record<string, string>;
       
       // Verify webhook
       wh.verify(payload, headers);
     } catch (error: any) {
       if (error.message.includes('missing')) {
         throw new Error('Missing required webhook headers');
       } else if (error.message.includes('signature')) {
         throw new Error('Invalid webhook signature');
       } else if (error.message.includes('timestamp')) {
         throw new Error('Webhook timestamp is too old or in the future');
       }
       throw new Error('Webhook verification failed');
     }
   }
   
   // Supabase SMS Hook endpoint: receive request and send SMS
   app.post('/hooks/send-sms', async (req: Request, res: Response) => {
     console.log('=== Received Supabase SMS Hook request ===');
     console.log('Request time:', new Date().toISOString());
     console.log('Request headers:', JSON.stringify(req.headers, null, 2));
     console.log('Request body:', JSON.stringify(req.body, null, 2));
     
     try {
       // Verify request
       verifySupabaseWebhook(req);
       console.log('JWT verification passed');
     } catch (error: any) {
       console.error('JWT verification failed:', error.message);
       return res.status(401).json({ 
         error: error.message || 'Unauthorized',
         code: 'UNAUTHORIZED'
       });
     }
   
     const { user, sms } = req.body;
     console.log('Parsed user info:', user);
     console.log('Parsed SMS info:', sms);
     
     // Validate required fields
     if (!user || !user.phone || !sms || !sms.otp) {
       console.error('Missing required fields:', { user, sms });
       return res.status(400).json({ error: 'Missing required fields: user.phone or sms.otp' });
     }
     
     const phone = user.phone;
     const otp = sms.otp;
     console.log('Phone number:', phone);
     console.log('OTP:', otp);
   
     // Extract digits only (remove prefixes like +86)
     const phoneNumber = phone.replace(/\D/g, '').slice(-11);
     console.log('Processed phone number:', phoneNumber);
   
     // Build template parameters. Default expiry is 5 minutes. Must match GOTRUE_SMS_OTP_EXP in Supabase.
     const templateParam = JSON.stringify({
       code: otp,
       min: '5'
     });
     console.log('SMS template parameters:', templateParam);
   
     try {
       const sendReq = new SendSmsVerifyCodeRequest({
         signName: SIGN_NAME,
         templateCode: TEMPLATE_CODE,
         phoneNumber: phoneNumber,
         templateParam: templateParam,
       });
       
       console.log('Preparing SMS request:', JSON.stringify(sendReq, null, 2));
   
       const runtime = new Util.RuntimeOptions({});
       const response = await client.sendSmsVerifyCodeWithOptions(sendReq, runtime);
       console.log('SMS service response:', JSON.stringify(response, null, 2));
         
       // Check success
       if (response.statusCode === 200 && response.body && response.body.success === true) {
         // Fix: Return JSON format expected by Supabase
         console.log('SMS sent successfully');
         return res.status(200).json({ success: true });
       } else {
         console.error('SMS failed:', {
           statusCode: response.statusCode,
           apiCode: response.body?.code,
           apiMessage: response.body?.message,
           apiSuccess: response.body?.success
         });
         return res.status(500).json({ 
           error: 'Failed to send SMS', 
           statusCode: response.statusCode,
           apiCode: response.body?.code,
           apiMessage: response.body?.message,
           apiSuccess: response.body?.success
         });
       }
     } catch (err: any) {
       console.error('Exception while sending SMS:', err);
       return res.status(500).json({
         error: err.message || 'Internal error',
         recommend: err.data?.Recommend,
       });
     }
   });

Step 2: Deploy to Function Compute. This step packages and deploys the code to Alibaba Cloud Function Compute.

1. Download and extract the project code to your local machine. In the .env file, set your Alibaba Cloud AccessKey, AccessSecret, SMS signature, and template.

   Note

   On macOS and Linux, the .env file may be hidden by default.

2. After updating the four files, package them. Then, run these commands:

   npm install
   npm run build
   zip -rq -y code.zip ./

3. Log on to the Function Compute console. Select the same region as your RDS Supabase instance, then click Create Function.

4. Select Web Function. Set the runtime environment to Node.js 20, then upload the code.zip package.

5. In Advanced Configuration, set the start command to npm start and the listening port to 80.

6. After creation, go to the function's details page. On the Triggers tab, find the public endpoint URL. Then, disable authentication for this trigger.

7. Record the public endpoint URL, which looks like https://xxx.ap-southeast-1.fcapp.run. You will use this as the Webhook URI in the next step.

8. (Optional) Test the Webhook endpoint. After deployment, test the function locally with curl. Replace phone with a test phone number that you registered in the Alibaba Cloud Short Message Service console.

   curl -X POST https://xxx.ap-southeast-1.fcapp.run/hooks/send-sms \
     -H "Content-Type: application/json" \
     -d '{
       "user": { "phone": "+861xxxxxxxxxx" },
       "sms": { "otp": "123456" }
     }'
   

   If configured correctly, the test phone will receive an OTP SMS.

Step 3: Configure the RDS Supabase instance

This step adds the Webhook details to your RDS Supabase instance.

1. Go to the details page of your RDS Supabase instance. Choose Auth Configuration > Phone Number > SMS Webhook.

2. Configure the following parameters:

   • SMS Sending: Set to true.

   • Enter an HTTPS URL for confirmation SMS: Enter the public endpoint URL that you obtained in Step 2, plus the path /hooks/send-sms. For example: https://xxx.fcapp.run/hooks/send-sms.

   • Hook Key: (Optional but recommended) Add a key to improve security. The format should start with v1,whsec_, followed by a 60-byte Base64-encoded string. If the format is incorrect, the backend generates a correct secret. This value must match the SMS_HOOK_SECRET environment variable in Function Compute.

     Hook key generation script

     # Generate 60 random bytes and encode as Base64
     SECRET=$(openssl rand -base64 60 | tr -d '\n')
     # Add prefix
     echo "v1,whsec_$SECRET"

   • SMS Auto Confirm: Set this option to false.

   • SMS OTP Time-to-Live (TTL) (seconds): Set how long the OTP remains valid, in seconds. The default value is 60.

3. Configure Function Compute environment variables (optional but recommended). To ensure that only your RDS Supabase instance calls this Webhook, you must sync the Webhook key to Function Compute if you have configured one. In the Function Compute console, find your function. In the Environment Variables section, add a variable named SMS_HOOK_SECRET. Its value must exactly match the Hook Key from the previous step. With this shared key, the function checks the x-supabase-webhook-signature header on every request and rejects unauthorized requests.

4. Submit the parameters and wait for the instance to restart.