Skip to main content

Source: ocean/docs/SUPABASE_MFA_SETUP.md | ✏️ Edit on GitHub

Supabase Multi-Factor Authentication (MFA) Setup

Overview​

To enhance security, Supabase recommends enabling multiple MFA options. Currently, we only have email OTP enabled, which triggers the security warning.

Current Status​

⚠️ Security Warning: Only 1 MFA method enabled (Email OTP) ✅ Recommended: Enable at least 2 MFA methods

  1. Email OTP (Currently Enabled)

    • Already configured for passwordless authentication

  2. SMS OTP (Recommended)

    • Requires Twilio integration
    • Provides phone-based verification

  3. TOTP (Authenticator Apps) (Recommended)

    • Works with Google Authenticator, Authy, etc.
    • Most secure option

Setup Instructions​

Enable Additional MFA Methods​

  1. Go to Supabase Dashboard - Auth Settings

  2. Scroll to Multi-Factor Authentication (MFA)

  3. Enable additional MFA factors:

    • Time-based One-Time Password (TOTP): Toggle ON
    • Phone (SMS): Toggle ON (requires Twilio setup)

  4. Click Save to apply changes

  1. Create a Twilio account

  2. Get your Account SID and Auth Token

  3. Configure in Supabase:

    TWILIO_ACCOUNT_SID=your_account_sid
    TWILIO_AUTH_TOKEN=your_auth_token
    TWILIO_MESSAGE_SERVICE_SID=your_service_sid
  1. In Supabase Dashboard > Authentication > Settings
  2. Enable "TOTP (Authenticator Apps)"
  3. Update your signup flow to optionally enroll users in TOTP

Implementation Notes​

  • Our current OTP email flow remains the primary authentication method
  • Additional MFA options are optional for users who want extra security
  • Consider implementing MFA enrollment during user onboarding

Security Best Practices​

  1. Require MFA for Admin Users: Enforce MFA for users with elevated privileges
  2. Grace Period: Allow users time to set up MFA before enforcing
  3. Recovery Codes: Provide backup codes for account recovery
  4. User Education: Guide users on the benefits of enabling MFA

Future Enhancements​

  • Add MFA enrollment flow to user settings
  • Implement role-based MFA requirements
  • Add security dashboard showing MFA adoption rates