Skip to main content
Deno 2 is finally here 🎉️
Learn more
Module

x/deco/deps.ts>supabase.GoTrueMFAApi

deco is the edge-native site editor and app framework for building dynamic, high-performance sites with a built-in visual admin UI.
deco-cx/deco
Go to Latest
interface supabase.GoTrueMFAApi
import { type supabase } from "https://deno.land/x/deco@1.40.2/deps.ts";
const { GoTrueMFAApi } = supabase;

Contains the full multi-factor authentication API.

Methods

enroll(params: MFAEnrollParams): Promise<AuthMFAEnrollResponse>

Starts the enrollment process for a new Multi-Factor Authentication (MFA) factor. This method creates a new unverified factor. To verify a factor, present the QR code or secret to the user and ask them to add it to their authenticator app. The user has to enter the code from their authenticator app to verify it.

Upon verifying a factor, all other sessions are logged out and the current session's authenticator level is promoted to aal2.

challenge(params: MFAChallengeParams): Promise<AuthMFAChallengeResponse>

Prepares a challenge used to verify that a user has access to a MFA factor.

verify(params: MFAVerifyParams): Promise<AuthMFAVerifyResponse>

Verifies a code against a challenge. The verification code is provided by the user by entering a code seen in their authenticator app.

unenroll(params: MFAUnenrollParams): Promise<AuthMFAUnenrollResponse>

Unenroll removes a MFA factor. A user has to have an aal2 authenticator level in order to unenroll a verified factor.

challengeAndVerify(params: MFAChallengeAndVerifyParams): Promise<AuthMFAVerifyResponse>

Helper method which creates a challenge and immediately uses the given code to verify against it thereafter. The verification code is provided by the user by entering a code seen in their authenticator app.

listFactors(): Promise<AuthMFAListFactorsResponse>

Returns the list of MFA factors enabled for this user.

getAuthenticatorAssuranceLevel(): Promise<AuthMFAGetAuthenticatorAssuranceLevelResponse>

Returns the Authenticator Assurance Level (AAL) for the active session.

  • aal1 (or null) means that the user's identity has been verified only with a conventional login (email+password, OTP, magic link, social login, etc.).
  • aal2 means that the user's identity has been verified both with a conventional login and at least one MFA factor.

Although this method returns a promise, it's fairly quick (microseconds) and rarely uses the network. You can use this to check whether the current user needs to be shown a screen to verify their MFA factors.