Supabase
Supabase issues no MFA recovery codes
This is a lockout problem, not a sharing problem. Supabase organization members with roles are the right way to give your team access. But Supabase does not issue recovery codes, and states it cannot restore access if all MFA factors are lost — so if the owner's device goes, the organization can go with it.
Try Organization members with roles (Owner first
Where this works, it is better than anything we offer: each person gets their own login, their own 2FA and their own audit trail.
- What it is called
- Organization members with roles (Owner, Administrator, Developer, Read-Only)
- Where to find it
- Supabase dashboard → Organization → Team
- Limits
- Fine-grained project-scoped roles require the Team or Enterprise plan. MFA is per user. No recovery codes are issued.
Where that runs out
Supabase gives you no recovery codes and will not restore access if every MFA factor is lost. An encrypted backup of the owner's TOTP seed is a legitimate answer to that, and it is a different need from sharing day-to-day access.
What Pair2FA does about it
1. Add the authenticator secret once
Scan the QR code Supabase shows during authenticator setup, or paste the Base32 key if it offers one. Supabase's documentation describes scanning only, so capture it at setup time.
2. It is encrypted before it is stored
AES-256-GCM at rest. The secret is never shown again unless someone with export permission explicitly asks for it and re-authenticates.
3. Grant only the people who need it
Viewers see the rotating six-digit code and nothing else. Access is per account, so someone working on one client never sees another. Revoking takes one click and is written to the audit log.
Supabase team access: common questions
Should my team use organization members instead?
Yes, for everyday access — that is what it is for, and each person gets their own login and their own MFA. This page is about a different risk: what happens when the owner's authenticator is lost.
Does Supabase give recovery codes?
No. Supabase's documentation states that it cannot restore account access if all MFA factors are lost. That makes the owner's authenticator a single point of failure for the organization.
Is storing a backup seed safe?
It is a trade-off, and you should understand it. Pair2FA encrypts seeds with AES-256-GCM but decrypts them server-side to generate codes, so it is not end-to-end encrypted. Weigh that against losing the organization entirely. For your most critical infrastructure, a second registered hardware device is better than any hosted backup.
What Pair2FA is not. It is not end-to-end encrypted. Secrets are decrypted on our server to generate codes, so a server compromise is part of the threat model. It is built to replace codes forwarded over chat and photographed QR codes, not to replace a hardware security key or a platform's own access controls. Our security page sets out the full threat model.