Hi all,

I’m evaluating managed authentication while retaining Supabase for the database. Users should type an emailed one-time code rather than follow a magic link.

The requirement is at most one successful redemption of each issued proof, including overlapping submissions. For example, two simultaneous verification requests using the same issued OTP must not create two independent sessions.

This is not a one-session-per-user rule: later independently authorized sign-ins and multiple sessions are allowed. A safely authorized retry returning the proven original result is also different from a second redemption creating another independent session.

Does anyone have firsthand implementation experience or public provider documentation establishing this behaviour for Supabase Auth, Amazon Cognito, Clerk, Auth0, or another supported managed approach?

My current understanding is that generic “single-use” wording and rejection of sequential reuse do not, on their own, establish concurrency safety.…