Keep generated links inside our app's domain?

[burggraf]

I have a problem with the auth workflow from a security / trust standpoint.

Let's say I create a new app at my brand new domain: BUY-MY-WIDGETS.COM.

1. User goes to my domain and sees a nice "sign up screen" and puts in their email address and password. So far so good.
2. Now, the user gets some sketchy looking emails from a domain they don't recognize:

https://super-sketchy-looking-url.supabase.co/auth/v1/verify?token=J-OH8vbgQP-ZEk7RW0zxHg&type=signup&redirect_to=http://localhost:8100/

https://super-sketchy-looking-url.supabase.co/auth/v1/verify?token=7F1Et7TfxBVSlOgD9RF2Tw&type=invite

3. The user now bails, because they barely trust BUY-MY-WIDGETS.COM, and now I'm asking them to send their browser to God-knows-where.

Ideally, the signup flow should send them to a URL within my own domain. Additionally, the link should be kept as short as possible, so it's easy for a user to inspect for phishing attempts, etc.

Could I generate these links and store them in a table in my database, then write a front-end process to simply read a UUID, look it up in the table, then redirect the app to the stored supabase.co domain?

Is there a better way to cleanly handle this?