Magic link always 'expired' for users with company Outlook email

Classic: Microsoft Defender Safe Links (and similar scanners) open every link in incoming mail to check it. That GET request uses up the one-time token. When the human clicks, it's already spent.

Fix: the link in the email must not log anyone in by itself. Make it land on a page with a "Continue to log in" button, and only call verifyOtp with the token_hash when the button is clicked. Scanners fetch the page but don't press buttons.

Or skip links for these customers and send the 6-digit code instead.

You can confirm the theory in the Supabase auth logs: the /verify request for a failing link comes a few seconds after the mail was sent, from a Microsoft IP range and a generic user agent, before your user ever clicked.

Agree with the button page. One more option if the customers are all on Microsoft: add Azure (Microsoft) as an OAuth provider. Corporate users usually prefer 'Sign in with Microsoft' anyway and you avoid email delivery entirely.