Comment by kiwicopple

hey HN, supabase ceo here

In case it's not clear - MFA is Multi Factor Authentication, and this one is for you, the developer, to use within your own apps

The neat thing about this one is that it flows all the way through to the JWT so that you can use it in a Postgres Row Level Security Policy:

    create policy "Enforce MFA for all end users."
      on table_name
      as restrictive
      to authenticated
      using ( auth.jwt()->>'aal' = 'aal2' );

You can see the `aal`, which is "Authenticator Assurance Level". This is aal1 for "no MFA", aal2 is 2 factor auth, etc...

A few of the team will be here to answer questions