A new row in Supabase,
an email and a WhatsApp go out.

# supabase/functions/.env (gitignored, local only)
# Created at app.unlimitedmessaging.app > API keys
UM_API_KEY=um_live_xxxx
# Any long random string, shared with the database webhook
WEBHOOK_SECRET=change-me-to-a-long-random-string

supabase functions new notify-signup

# Push the secrets to your project (never to the frontend)
supabase secrets set --env-file supabase/functions/.env
supabase secrets list

// supabase/functions/notify-signup/index.ts
type Profile = { id: string; email: string; phone: string | null; full_name: string | null };
type WebhookPayload = {
  type: 'INSERT' | 'UPDATE' | 'DELETE';
  table: string;
  schema: string;
  record: Profile;
  old_record: Profile | null;
};

Deno.serve(async (req) => {
  // The database webhook sends this header; nobody else knows it
  if (req.headers.get('x-webhook-secret') !== Deno.env.get('WEBHOOK_SECRET')) {
    return new Response('Unauthorized', { status: 401 });
  }

  const { record } = (await req.json()) as WebhookPayload;
  const name = record.full_name ?? 'there';

  // Email always, WhatsApp when the row has a phone (E.164: +33612345678).
  // Use { channel: 'SMS' } instead for people who are not on WhatsApp.
  const channels: Array<{ channel: 'EMAIL' | 'WHATSAPP' | 'SMS' }> = [{ channel: 'EMAIL' }];
  if (record.phone) channels.push({ channel: 'WHATSAPP' });

  const res = await fetch('https://api.unlimitedmessaging.app/message', {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${Deno.env.get('UM_API_KEY')}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      to: { email: record.email, phone: record.phone ?? undefined },
      channels,
      subject: 'Welcome aboard',
      text: `Hi ${name}, your account is ready. Reply to this message if you need anything.`,
      priority: 'transactional',
    }),
  });

  if (!res.ok) console.error('Unlimited Messaging', res.status, await res.text());
  return new Response(null, { status: res.ok ? 200 : 502 });
});

# A database webhook sends no user JWT: turn the platform check off
# for this function only, the x-webhook-secret header protects it
supabase functions deploy notify-signup --no-verify-jwt

# Or keep it in supabase/config.toml:
# [functions.notify-signup]
# verify_jwt = false

{
  "type": "INSERT",
  "table": "profiles",
  "schema": "public",
  "record": {
    "id": "8f1c2d3e-0000-4000-8000-000000000000",
    "email": "[email protected]",
    "phone": "+33612345678",
    "full_name": "Lea"
  },
  "old_record": null
}