Is it possible to set up 2FA/MFA in Supabase using REST APIs?

[ebamoh1]

Can we set up 2FA/MFA using REST endpoints in Supabase? If this is already possible, can someone you please share the documentation since I couldn't find it?

Currently, the only option I see available is to use Javascript but for security purposes and efficiency, we prefer to handle auth and other sensitive actions through the backend server as that allows us to easily add in additional logic and checks (both on the database and using other external resources which are accessible by REST APIs).

I'm exploring migrating our app to Supabase and want to use the TOTP Auth MFA but can't see an easy way to integrate that option to work with our server-based flows. We currently use Twilio's Verify REST endpoints to provide 2FA/MFA and if switching to Supabase, we would rather have all Authentication handled from one place (https://www.twilio.com/docs/verify/quickstarts/totp).

Thanks.

[GaryAustin1]

Well it has to be possible because the JS client only uses the auth REST API.
Documented is another thing...
This has some mfa endpoints: https://github.com/supabase/auth/blob/master/openapi.yaml
This is the best detail on endpoints, but does not mention MFA that I see: https://github.com/supabase/auth?tab=readme-ov-file#endpoints
And then you could always look at what the auth-js client does. Example: https://github.com/supabase/auth-js/blob/8af88b6f4e41872b73e84c40f71793dab6c62126/src/GoTrueClient.ts#L2441

[ebamoh1]

Thank you, @GaryAustin1. The MFA endpoints link was particularly helpful and have every MFA endpoint in REST apart from one to "Get Authenticator Assurance Level". So I'll manage with the ones available for now.