Multi-Factor Authentication for Admin Panel [Dashboard]

[dschnabel]

Update: this is now implemented and available on supabase.com

---

It seems that MFA is currently not possible for the admin panel (https://app.supabase.com/), only for projects. Securing the admin panel with MFA seems like an important feature to have, since an attacker could gain access to all the admin's projects and users data.

Are there any plans to add MFA to the admin panel?

[BigDarkAkula]

This seems like pretty serious vulnerability that will prohibit many users from being able to adopt the platform.

[J0]

Hey @dschnabel, @BigDarkAkula

Thanks for our feedback! Adding MFA to our platform is on our roadmap - do stay tuned!

Jo

[rogerclark]

Any updates on this? This seems really important. Thanks!

[ryanparks]

Same boat -- our team is hoping to deploy a product with Supabase under the hood, but this gives us pause.

[BigDarkAkula]

Would self hosting be the alternative here to make sure your supabase instance secure from a brute force or some other type of attack? I REALLY don't want to do that. It would be really nice to know what the time horizon looks like to implement this type of functionality.

[rohovskoi]

Hi @J0, is there an update on 2MFA for the admin dashboard? That's a significant roadblock for us.

[lazarette]

Agree - nothing secure can be hosted on supabase when no data hosted here has mfa protection... I'd like to see MFA and IP restrictions on the admin panel.

[lukereichold]

Would pay for this! The lack of this feature is currently a dealbreaker for using Supabase for client projects 😞

[carlosfarfangalindoNL222]

Please add this feature, this is really a big vulnerability!

[dschnabel]

@J0 any progress on this?

[sigma-andex]

According to @awalias it's on the way..

[J0]

Hey all,

Thanks for waiting - MFA is available on the dashboard now. Do read the docs around it here. You can enroll an MFA (TOTP) factor on the security page

Going to close the thread but we will continue to take feedback in this discussion thread. Alternatively, feel free to open a separate thread as well.

Thanks!