Multi-factor Authentication
Enable multi-factor authentication (MFA) to keep your account secure.
This guide is for adding MFA to your Supabase user account. If you want to enable MFA for users in your Supabase project, refer to this guide instead.
Multi-factor authentication (MFA) adds an additional layer of security to your user account, by requiring a second factor to verify your user identity. Supabase allows users to enable MFA on their account and set it as a requirement for subsequent logins.
Supported authentication factors
Currently, Supabase supports adding a unique time-based one-time password (TOTP) to your user account as an additional security factor. You can manage your TOTP factor using apps such as 1Password, Authy, Google Authenticator or Apple's Keychain.
Enable MFA
You can enable MFA for your user account under your Supabase account settings. Enabling MFA will result in all other user sessions to be automatically logged out and forced to sign in again with MFA.
For security reasons, we will not be able to restore access to your account if you lose all your two-factor authentication credentials. We recommend you register a backup factor.
Sign in with MFA
Once you've enabled MFA for your Supabase user account, you will be prompted to enter your second factor challenge code as seen in your preferred TOTP app.
If you are an organization owner and on the Pro, Team or Enterprise plan, you can enforce that all organization members must have MFA enabled.
Recovery codes
Recovery codes let you complete the MFA step if you lose access to your authenticator app. You get 10 codes, and each code works once. Store them somewhere safe, such as a password manager.
When you enable MFA, the Supabase dashboard generates your recovery codes and shows them once. Copy or download them before you close the dialog.
Sign in with a recovery code
If you can't use your authenticator app, sign in with a recovery code:
- Sign in with your usual method.
- On the two-factor authentication screen, under Unable to sign in?, click Authenticate using a recovery code.
- Enter one of your recovery codes.
After 5 incorrect codes, sign-in with a recovery code is locked for 15 minutes.
If you lost your authenticator app, go to Account → Security → Multi-factor authentication:
- If you have one authenticator registered, click Add MFA method and verify the new authenticator. Then click Remove MFA method for the lost authenticator.
- If you have two authenticators registered, remove the lost authenticator while keeping your backup. Then click Add MFA method and verify its replacement.
Removing your last MFA method disables MFA and deletes your recovery codes.
Generate or regenerate recovery codes
Your account security settings show how many recovery codes you have left. If your account has MFA but no recovery codes, click Generate recovery codes. To replace your codes with a new set, click Regenerate. Your previous codes stop working immediately.
Disable MFA
You can disable MFA for your user account under your Supabase account settings. On subsequent sign-in attempts, you will not be prompted to enter an MFA code. Disabling MFA also deletes your recovery codes.
We strongly recommend that you do not disable MFA to avoid unauthorized access to your user account.