Open Settings → Preferences to manage sign-in security for your user account.
Two-factor authentication
Two-factor authentication adds a second step after the password. You can enable either or both methods:
- Authenticator app: scan the QR code with any TOTP-compatible app and enter its current 6-digit code.
- Email codes: confirm the first 6-digit code sent to your account email. Future sign-ins send a new code that expires after 10 minutes.
Turning a method on or off always requires a successful code confirmation. If both methods are enabled, the sign-in screen lets you switch between them.
Email-code messages use the workspace SMTP relay on a whitelabel workspace or domain. Customer workspaces inherit their reseller’s relay. When no workspace relay is configured, the platform SMTP configuration is used.
MFA management is intentionally limited to an interactive Supabase user session. It is not exposed through API keys or MCP because those credentials must not be able to weaken the account’s sign-in policy.
Where you are signed in
The same Preferences page lists tracked devices with active native Auth sessions. The list shows the browser, operating system, last activity time, and IP address when available.
Choose Sign out on a device you do not recognise. This revokes that session’s refresh-token family and immediately blocks its remaining access token from platform APIs and database access.
For privacy and security, the platform stores the native session ID and device metadata only. Access tokens and refresh tokens are never stored in the device list. 
