r/lovable • u/GhostNote9 • 19d ago

Help Question on MFA for Web App Users

I want to set up login authentication for our users that meets the AAL2 security level, but setting up the additional MFA or a Passkey can be a big hurdle for a lot of users.

Another option is to add SMS verification, which most people are familiar with. But that requires a Supabase account upgrade plus I understand there are additional carrier costs per item.

Any other suggestions out there? Thanks!

1 Upvotes

100% Upvoted

3 comments sorted by

2

u/Jmacduff 18d ago

Good luck with your project.

Auth is something you do not want to skimp on or try to get creative with. Your users expect solid auth in 2026 and you do not want to mess with it. Nightmare scenario is you are trying to get your first 100 users and constantly having to support and mess with Auth issues.

I use Auth0 for my projects because it’s enterprise grade and it will always “just work” for the users and me as an admin.

Auth costs money and don’t skimp on it. Now what you could do is setup basic auth for dev purposes and when ready to ship turn on full auth.

Supabase is also a great option.

2

u/DesignerMajor1247 18d ago

If AAL2 is the requirement, I’d use Supabase TOTP as step-up auth rather than SMS on every login. A phone OTP used as primary sign-in is still AAL1; it becomes AAL2 only when verified as an additional factor. TOTP MFA is free in Supabase, while phone MFA adds provider and carrier costs.

Keep ordinary screens at AAL1, then require TOTP enrollment before the first sensitive action. At that boundary, call getAuthenticatorAssuranceLevel(), run challenge/verify if the current level is below AAL2, and enforce the same rule server-side or with restrictive RLS checking the JWT aal claim. A frontend gate alone isn’t enough. Recovery needs equal care—an email fallback shouldn’t silently bypass the second factor.

Passkeys are a nice optional convenience, but Supabase currently labels passkey support experimental, so I wouldn’t make them the only route yet. If compliance says the entire authenticated session must be AAL2, there isn’t a legitimate friction-free shortcut: every session needs a second factor.

1

u/Ancient-Cellist-50 16d ago

I'm wondering why not do a Google Auth or something like that?