MFA Setup
Enable multi-factor authentication (MFA) using a TOTP authenticator app or a passkey. MFA adds a second layer of security and is required for sensitive operations like managing API keys and gateway tokens.
What is MFA?
Multi-factor authentication requires two forms of identification: your password (something you know) and a time-based one-time password from an authenticator app (something you have). This protects your account even if your password is compromised.
When MFA is required
Clevername enforces MFA for high-security operations through Supabase's AAL (Authenticator Assurance Level) integration. These operations include:
- Creating or deleting API keys
- Creating or revoking gateway tokens
- Changing account email or password
- Managing organization SSO or SCIM settings
Supported factors
Any TOTP-compatible authenticator app works with Clevername. Popular options include Google Authenticator, Authy, 1Password, and Microsoft Authenticator. Passkeys (WebAuthn) are also supported and satisfy the step-up for key and token management; register them from the Account tab or the passkeys page at /dashboard/settings/passkeys.
Open Account settings
Go to Settings → Account in the dashboard (there is no Security tab). Scroll to the Two-Factor Authentication section.
Start MFA enrollment
Click Enable MFA. A QR code will appear on screen. You will also see a text-based secret key for manual entry.
Scan the QR code
Open your authenticator app and scan the QR code. The app will add a Clevername entry and start generating 6-digit codes that refresh every 30 seconds.
Verify with a code
Enter the current 6-digit code from your authenticator app into the verification field and click Verify. This confirms your app is set up correctly.
Confirm MFA is active
Once verified, MFA is active on your account. The Two-Factor Authentication section will show MFA as Enabled. You will be prompted for a TOTP code (or your passkey) when performing sensitive operations.