Removing needs a code from your app, so a stolen password alone can't turn this off.
Authenticator app
Off
Add a time-based code from an app like 1Password, Apple Passwords,
Google Authenticator, or Authy.
Scan this code
Open your authenticator app.
Scan the square below, or type the setup key by hand.
Enter the 6-digit code it shows you.
Turning this on is only half the job — the database has to require it too.
Run mfa.sql in the Supabase SQL editor after
this page says On. See SECURITY-SETUP.md.