Supabase 2FA: how to set up an authenticator app for your dashboard account

This guide is about the account you use to sign in to the Supabase dashboard, where you manage your organizations and projects. Two-factor authentication (2FA) for the users of an app you build on Supabase is a separate feature with its own docs.

For your own account, the only second factor Supabase lists is a code from an authenticator app (TOTP). It's optional unless an organization you belong to requires it. Read the recovery part before you start: Supabase gives no recovery codes, and its docs say "we will not be able to restore access to your account" once every factor is lost (Supabase). Plan for two authenticator apps, not one.

The steps use Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: Supabase's documentation covers dashboard 2FA in a few short paragraphs and names no buttons, so the Supabase steps also come from the dashboard's open-source code on GitHub, which gave us the screen labels. Everything is linked below, and we read it on October 20, 2026. We haven't tested the steps on a Supabase account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

When an organization requires it

On the Pro, Team and Enterprise plans, an organization owner can switch on Require MFA to access organization, after setting up 2FA on their own account. Members without 2FA lose access to the organization's projects at once, and get it back as soon as they set it up. Personal access tokens aren't affected (Supabase).

Turn on 2FA with an authenticator app

The setting is on the Security page of your account settings, at supabase.com/dashboard/account/security (Supabase). The labels below come from the dashboard code (Supabase source, Supabase source):

1. Open your profile menu, choose Account, then Security in the sidebar.
2. Under Multi-factor authentication, select Add app.
3. Fill in Authenticator app name, such as "Novaz on iPhone", and select Generate QR. Supabase shows this name when it asks for a code.
4. In Novaz, tap +, then Scan QR code, and point the camera at the code. On the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
5. If scanning fails, the Unable to scan? box shows the secret key. In Novaz, tap +, then Enter key manually, and paste it as the Setup key. See What is a 2FA setup key?
6. Type the code from Novaz in Authentication code and select Confirm.

If you cancel at the last step, the dashboard discards the unfinished entry, so delete it from Novaz as well. Turning 2FA on signs out your other sessions (Supabase).

Add a second app now

Supabase's backup plan is a second factor: another authenticator app on a different device, or the secret key stored somewhere apart from the first app (Supabase). The dashboard takes up to two apps, and while you have one it shows Avoid being locked out with an Add another app button (Supabase source).

Without a Novaz backup (iCloud backup or a backup file), its keys exist only on your iPhone, so put the second app on another device, such as an iPad. If you keep the secret key instead, store it off that iPhone, in a password manager for example. Anyone who has it can make your codes.

Signing in with a code

Every sign-in then asks for a code, including sign-in with GitHub, on a screen titled Two-factor authentication that names the app it expects. With two apps, Authenticate using plus the other app's name switches to your backup (Supabase source, Supabase source). Resetting a forgotten password asks for a code first, too (Supabase source).

If Supabase rejects your code

The dashboard docs don't cover this. The dashboard checks codes with Supabase Auth, whose docs say a code is valid for one 30-second interval, with one extra interval allowed for clock drift (Supabase). So check your iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns when it's 15 seconds or more off. With two apps, make sure you're using the one the screen names. More in Authenticator code not working?

Changing phones

Do it while the old iPhone still works. With one app registered, use Add another app for Novaz on the new iPhone, then select Delete next to the old entry. With two already, delete the old phone's entry first, since there's no room for a third, then add the new one (Supabase source). If you have a Novaz iCloud backup or backup file, you can instead restore your accounts on the new iPhone and keep the same entry; see How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

• Second app: pick it on the sign-in screen, then replace the lost entry.
• Saved secret key: add it to an authenticator app on another device.
• Neither: for accounts that don't use SSO, Supabase says it can't restore access. It asks you to contact support if you've only forgotten which app you used, and SSO users to contact support (Supabase).

The sign-in screen's Email support to regain access link writes to support@supabase.com (Supabase source). Supabase doesn't say what proof it asks for or how long it takes. See Lost the phone with your authenticator app?

Turning 2FA off

On the Security page, select Delete next to each app and confirm. Deleting the last one shows Multi-factor authentication will be disabled, and cuts you off from organizations that require 2FA (Supabase source). Supabase strongly advises against turning it off (Supabase).

Official Supabase help

• Multi-factor Authentication
• Enforce MFA on Organization
• Lost access/Forgot the MFA device
• Multi-Factor Authentication (TOTP)
• Supabase dashboard source code on GitHub: account Security page, add app dialog, delete dialog, sign-in code screen, password reset code screen