nextauthjs · ndom91 · Mar 22, 2022 · Feb 9, 2022 · Feb 12, 2022 · Mar 12, 2022
diff --git a/docs/docs/guides/fullstack.md b/docs/docs/guides/fullstack.md
@@ -15,6 +15,10 @@ title: Fullstack
 
 - Add support for HTTP/HTTPS Proxy support to `openid-client` in order to use NextAuth.js behind a corporate proxy or other locked down network.
 
+### [Using the Email Provider behind Corporate Email Scanning Services](/tutorials/avoid-corporate-link-checking-email-provider)
+
+- An internal tutorial on modifying the catch-all API Route to gracefully handle `HEAD` requests.
+
 ## Database
 
 ### [Custom models with TypeORM](/adapters/typeorm#custom-models)

diff --git a/docs/docs/tutorials/avoid-corporate-link-checking-email-provider.md b/docs/docs/tutorials/avoid-corporate-link-checking-email-provider.md
@@ -0,0 +1,40 @@
+---
+id: corporate-link-checking-email-provider
+title: Allow Email Signups Behind Corporate Link Checker
+---
+
+If you use Office 365 or Outlook, or potentially other Email systems, you may notice your Email invitation Links not working.
+
+This is because the invitation Email your User is receiving is being scanned by the Email provider. In the specific case of Outlook and their "SafeLink" feature, they send a HEAD request to each link in the Email. This request will trigger the NextAuth.js catch-all API Route with the users invitation token, in effect using it up.
+
+Therefore, when the user wants to use it themselves, and clicks on the invitation link they will be greeted with an error message that the invitation is invalid.
+
+## Workarounds
+
+### Disable "SafeLink"
+
+The first potential workaround is to simply disable this "SafeLink" feature for your organisation. Microsoft has more details on this [here](https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/safe-links?view=o365-worldwide#do-not-rewrite-the-following-urls-lists-in-safe-links-policies). Obviously this won't be an option for everyone as this is usually a part of corporate IT policy.
+
+### Update NextAuth.js for 'HEAD' requests
+
+The second option is to modify your `[...nextauth].js` catch-all API route a bit to gracefully handle these initial `HEAD` requests from the email service, without accidentally using up the invitation link.
+
+This can be done by simply returning a `200` response on `HEAD` requests at the very top of the API route, before any other logic is executed.
+
+For example
+
+```jsx title="/pages/api/auth/[...nextauth].js"
+import type { NextApiRequest, NextApiResponse } from "next"
+import NextAuth from "next-auth"
+
+export default async function auth(req: NextApiRequest, res: NextApiResponse) {
+
+  if(req.method === "HEAD") {
+     return res.status(200)
+  }
+
+  ...
+}
+```
+
+This should allow you to successfully use NextAuth.js's Email provider behind strict corporate IT settings.