---
title: "Securing your Flutter apps with Multi-Factor Authentication"
description: "The tutorial presents a Flutter app that requires multi-factor authentication before users can view its content, using email and password login followed by authenticator-app verification. It uses Supabase for authentication, supabase_flutter for client integration, go_router for routes and redirects, and flutter_svg to display a QR code for authenticator enrollment. During signup, users confirm their email through a deep link, enroll MFA, and then verify a code; login applies a similar second step. iOS and Android deep-link configuration directs the confirmation callback to the enrollment route, while routing checks the session and authenticator assurance level to send users to registration, enrollment, or verification as appropriate. The stated outcome is that only users who have signed in via MFA can access the home page, while optional MFA is identified as a possible future variation."
---

# Securing your Flutter apps with Multi-Factor Authentication

[Supabase](https://yomu.fyi/company/supabase) · tyler\_shukert · May 4, 2023

**Type:** Tutorial

## Summary

The tutorial presents a Flutter app that requires multi-factor authentication before users can view its content, using email and password login followed by authenticator-app verification. It uses Supabase for authentication, supabase\_flutter for client integration, go\_router for routes and redirects, and flutter\_svg to display a QR code for authenticator enrollment. During signup, users confirm their email through a deep link, enroll MFA, and then verify a code; login applies a similar second step. iOS and Android deep-link configuration directs the confirmation callback to the enrollment route, while routing checks the session and authenticator assurance level to send users to registration, enrollment, or verification as appropriate. The stated outcome is that only users who have signed in via MFA can access the home page, while optional MFA is identified as a possible future variation.

## Context

The app is intended to protect sensitive user data and prevent unauthorized access by requiring an additional authentication factor. The tutorial treats MFA as a necessary security measure for this app's access flow, rather than allowing email-and-password authentication alone.

## Approach / What changed

The implementation combines Supabase authentication with Flutter pages for registration, login, MFA enrollment, MFA verification, and protected content. It configures go\_router redirects based on the current session and authenticator assurance level, uses an authenticator app and QR code for enrollment, and adds iOS and Android deep links so email confirmation can open the enrollment route.

## Takeaways

- Supabase MFA enrollment follows email confirmation and uses an authenticator app, with a QR code displayed through flutter\_svg.
- go\_router checks the session and authenticator assurance level to redirect users to registration, MFA enrollment, or MFA verification.
- The demonstrated flow restricts access to the home page until the user has completed MFA; making MFA optional would require code changes.

**Tags:** [Android](https://yomu.fyi/topic/android), [Authentication](https://yomu.fyi/topic/authentication), [iOS](https://yomu.fyi/topic/ios)

- Source: [Supabase](https://supabase.com/blog/flutter-multi-factor-authentication)
- Source URL: https://supabase.com/blog/flutter-multi-factor-authentication
- Ingested by Yomu: 2026-08-29T01:17:54.123Z

[Read original post](https://supabase.com/blog/flutter-multi-factor-authentication)