Next.js integration · server route

Next.js disposable email validation

Put the check in a route handler or server action so a caller cannot bypass it by skipping your browser UI.

Answer: validate the email at app/api/signup/route.ts before calling your Auth provider. Return a stable public code and keep provider stack details out of the response.

Route handler

import { NextResponse } from 'next/server'
import { isDisposableEmail } from '@internal/disposable-email-core'

export async function POST(request: Request) {
  const body = (await request.json()) as { email?: unknown }
  const email = typeof body.email === 'string' ? body.email : ''

  if (isDisposableEmail(email)) {
    return NextResponse.json(
      { code: 'SIGNUP_EMAIL_NOT_ALLOWED' },
      { status: 400 }
    )
  }

  return NextResponse.json({ accepted: true })
}

Implementation checklist

Keep the matcher on the server; the browser check is only UX.
Handle invalid_input separately from a disposable match.
Keep an allowlist for reviewed exceptions.
Retain rate limits, CAPTCHA, email verification, and provider abuse controls.
Test both user@vtmpj.com and user@gmail.com.

See the JSON contract →Source guide