Multi-factor Authentication via Row Level Security Enforcement

Summary

Supabase announces the release of multi-factor authentication (MFA) for everyone and describes dashboard Single Sign-On (SSO) as preparation for a future SAML release; SSO is available on Enterprise plans by contacting the company. The implementation starts with Time-Based One-Time Passwords (TOTP), where an authenticator generates a short-lived code from a shared secret and the current time, exchanged through a QR code or entered manually. Enrollment uses /enroll, /challenge, and /verify, while subsequent sign-ins require a challenge and verification before a JWT is issued with Authenticator Assurance Level (AAL) and Authenticator Method Reference (AMR) claims. Those claims support full or selective enforcement through restrictive Postgres Row Level Security policies, including checks that require aal2 or require it only for users with verified MFA factors; planned additions include WebAuthn, FIDO2 devices, and email notifications.

Takeaways

1. 1

   TOTP codes are six digits and typically valid for 30 seconds or less; the example uses SHA1, six digits, and a 30-second period.

2. 2

   The challenge endpoint separates MFA initiation from verification, supporting flows such as requesting a challenge before using a Yubikey.

3. 3

   PostgreSQL policies are permissive by default and combine with an OR clause, so policies must be marked restrictive when multiple MFA checks need to apply.