Add two-factor authentication

Tools that power the Add two-factor authentication stack

• Supabase Auth — MFA provider

  Built-in TOTP multi-factor authentication with QR code enrollment flow

  See all stacks using Supabase Auth

• Twilio Verify — SMS verification

  Send one-time passcodes via SMS or voice call with global delivery

  See all stacks using Twilio Verify

• Authy — 2FA authenticator app

  Twilio's end-user authenticator app with cloud backup for TOTP codes

  See all stacks using Authy

• Google Authenticator — TOTP app

  Widely-used TOTP app that generates 6-digit codes every 30 seconds

  See all stacks using Google Authenticator

Setup guide

1. Supabase Auth: Use the current Supabase MFA enrollment flow: call supabase.auth.mfa.enroll({ factorType: "totp" }), display its QR code, and confirm enrollment with challengeAndVerify({ factorId, code }). Require a fresh MFA challenge when appropriate and enforce an aal2 session in protected server routes and database policies. Test enrollment, an incorrect code, a new login, and recovery; a client-only check is insufficient. (Read TOTP setup)
2. Twilio Verify: If you choose Twilio Verify for SMS verification, create a Verify service and call the server SDK verifications.create and verificationChecks.create methods. The REST resources are POST /v2/Services/{ServiceSid}/Verifications and POST /v2/Services/{ServiceSid}/VerificationCheck. Bind each challenge to the authenticated session and check approved status server-side. A permanent phone-verified flag is not proof of MFA for future sessions; keep credentials server-side and rate-limit attempts. (Read official instructions)
3. Authy: Offer Authy as one compatible TOTP authenticator, not an additional backend requirement. Let the user scan the enrollment QR code and confirm a valid code before enabling the factor. Explain Authy backup settings and the need to retain its backup password if used; do not promise automatic recovery. Provide and test the recovery procedure actually supported by your authentication system. (Read official instructions)
4. Google Authenticator: Offer Google Authenticator as another compatible TOTP app. Label the enrollment QR code with your service and account using the otpauth issuer and account label. Confirm enrollment with a valid code. Document device-loss recovery separately; authenticator apps do not automatically add recovery codes to your application. Test the supported recovery flow before requiring MFA. (Open Google Authenticator instructions)

   Check: Enrollment and a fresh login require a valid challenge; invalid codes and lower-assurance sessions cannot access protected data, and the documented recovery flow is tested.