Locked out of Pro account — spurious 6-digit TOTP/2FA prompt after GitHub SSO that I never enabled (ticket SU-404571)

[apatten04-ccai]

I am locked out of my Supabase dashboard and would appreciate help getting my ticket onto the informal escalation queue.

Login method: GitHub OAuth. My GitHub account is healthy, I am signed in to GitHub normally, and GitHub's own 2FA works fine everywhere else.

The issue: Immediately AFTER the GitHub OAuth handshake completes and Supabase takes over, the dashboard forces me to a 6-digit TOTP / 2FA code screen on supabase.com — but I never enabled MFA on my Supabase account. I have no authenticator entry and no recovery codes, because I never set one up. I therefore have no 6-digit code to enter, and it locks me out completely. This matches the recurring server-side "false 2FA after GitHub SSO" pattern noted in other threads (#27802, #46339, #46133).

Already ruled out a local cause:
•Clean incognito session and a different browser entirely — prompt persists.
•Cleared cookies/site data for github.com and supabase.com — prompt persists.
•Confirms the factor is server-side state on the account, not local.
•Password reset is not applicable: the account is GitHub-authorized only (the reset flow confirmed this), and the block is the post-OAuth TOTP screen, not a password.

Prior contact: My first email had no reply for days. I have now re-sent to support@supabase.com from my registered account email and received ticket SU-404571.

Request: @GaryAustin1 — could you please add ticket SU-404571 to the informal escalation queue so the team can verify ownership and reset/remove the server-side MFA (TOTP) factor on this account?

•Support ticket #: SU-404571

•Registered account email: apatten04@gmail.com (GitHub-authorized)

•GitHub username: apatten04-ccai

•Organization: CCAI

•Project: CCAI - Prod / project ref: dlvamhwptywnzsmcjwdn (cultureconnect-prod)

I have ownership proof ready (billing/invoice, org, project ref, recent activity) the moment support reaches out. Thank you so very much!

[GaryAustin1]

So you don't have ticket #'s from earlier?
Also even if in the informal queue (once it gets seen there), we have been told the security team at SB is VERY backed up. I would not expect a few days.

[apatten04-ccai]

Sorry I was confusing. Yes, I do have a ticket number and I did get an email to confirm my identity, but that was five days ago and I have not heard back since thank you so much for your help and insight. Get Outlook for iOS<https://aka.ms/o0ukef>

…

________________________________ From: GaryAustin1 ***@***.***> Sent: Tuesday, 30 June 2026 12:34:47 To: supabase/supabase ***@***.***> Cc: apatten04-ccai ***@***.***>; Author ***@***.***> Subject: Re: [supabase/supabase] Locked out of Pro account — spurious 6-digit TOTP/2FA prompt after GitHub SSO that I never enabled (ticket SU-404571) (Discussion #47459) So you don't have ticket #'s from earlier? Also even if in the informal queue (once it gets seen there), we have been told the security team at SB is VERY backed up. I would not expect a few days. — Reply to this email directly, view it on GitHub<#47459?email_source=notifications&email_token=B4XVBKKWUWUSSHX26RLGBFT5CP23PA5CNFSNUABIM5UWIORPF5TWS5BNNB2WEL2ENFZWG5LTONUW63SDN5WW2ZLOOQXTCNZUHA3TONJRUZZGKYLTN5XKMYLVORUG64VFMV3GK3TUVRTG633UMVZF6Y3MNFRWW#discussioncomment-17487751>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/B4XVBKI55YLAZVPN3GEPQ5L5CP23PAVCNFSNUABIKJSXA33TNF2G64TZHMZDCNBVHA3TCOJTHNCGS43DOVZXG2LPNY5TCMBTGQ3TONBSUF3AE>. You are receiving this because you authored the thread.Message ID: ***@***.***>

[apatten04-ccai]

Unfortunately, my platform has a launch date of early next week and this is the only thing holding it back. Is there anyway to get An understanding of What I need to do or if I am just to wait until they get to me. This is urgent also, I'm curious as to why this would happen out of the blue. It worked fine for weeks and weeks and then this. Thank you again for your response. Get Outlook for iOS<https://aka.ms/o0ukef>

…

________________________________ From: Andrea Patten ***@***.***> Sent: Tuesday, 30 June 2026 12:54:42 To: supabase/supabase ***@***.***>; supabase/supabase ***@***.***> Cc: Author ***@***.***> Subject: Re: [supabase/supabase] Locked out of Pro account — spurious 6-digit TOTP/2FA prompt after GitHub SSO that I never enabled (ticket SU-404571) (Discussion #47459) Sorry I was confusing. Yes, I do have a ticket number and I did get an email to confirm my identity, but that was five days ago and I have not heard back since thank you so much for your help and insight. Get Outlook for iOS<https://aka.ms/o0ukef>

________________________________ From: GaryAustin1 ***@***.***> Sent: Tuesday, 30 June 2026 12:34:47 To: supabase/supabase ***@***.***> Cc: apatten04-ccai ***@***.***>; Author ***@***.***> Subject: Re: [supabase/supabase] Locked out of Pro account — spurious 6-digit TOTP/2FA prompt after GitHub SSO that I never enabled (ticket SU-404571) (Discussion #47459) So you don't have ticket #'s from earlier? Also even if in the informal queue (once it gets seen there), we have been told the security team at SB is VERY backed up. I would not expect a few days. — Reply to this email directly, view it on GitHub<#47459?email_source=notifications&email_token=B4XVBKKWUWUSSHX26RLGBFT5CP23PA5CNFSNUABIM5UWIORPF5TWS5BNNB2WEL2ENFZWG5LTONUW63SDN5WW2ZLOOQXTCNZUHA3TONJRUZZGKYLTN5XKMYLVORUG64VFMV3GK3TUVRTG633UMVZF6Y3MNFRWW#discussioncomment-17487751>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/B4XVBKI55YLAZVPN3GEPQ5L5CP23PAVCNFSNUABIKJSXA33TNF2G64TZHMZDCNBVHA3TCOJTHNCGS43DOVZXG2LPNY5TCMBTGQ3TONBSUF3AE>. You are receiving this because you authored the thread.Message ID: ***@***.***>

[GaryAustin1]

For everyone in this (or similar) locked out states from Github issues, real 2fa issues, false 2fa issues, etc. it is urgent. That team is very backed up. I have no idea for how long or if it is getting better soon as we don't have a view inside Supabase.

I added your ticket to the informal queue based on you saying you have an older email submitted even though your ticket # is too soon for us to normally bump.

Only thing I did not see on your list for "false" 2fa (versus you lost 2fa which is a different story) is to try another device.

[apatten04-ccai]

It is a false two FA and I have tried several devices to see If my GitHub authorization worked. I never had a Supabase 2FA. Again, thank you for your help. I greatly appreciate it. Get Outlook for iOS<https://aka.ms/o0ukef>

…

________________________________ From: GaryAustin1 ***@***.***> Sent: Tuesday, 30 June 2026 13:03:38 To: supabase/supabase ***@***.***> Cc: apatten04-ccai ***@***.***>; Author ***@***.***> Subject: Re: [supabase/supabase] Locked out of Pro account — spurious 6-digit TOTP/2FA prompt after GitHub SSO that I never enabled (ticket SU-404571) (Discussion #47459) For everyone in this (or similar) locked out states from Github issues, real 2fa issues, false 2fa issues, etc. it is urgent. That team is very backed up. I have no idea for how long or if it is getting better soon as we don't have a view inside Supabase. I added your ticket to the informal queue based on you saying you have an older email submitted even though your ticket # is too soon for us to normally bump. Only thing I did not see on your list for "false" 2fa (versus you lost 2fa which is a different story) is to try another device. — Reply to this email directly, view it on GitHub<#47459?email_source=notifications&email_token=B4XVBKPIR7MBDA7SO7TCHMT5CP6HVA5CNFSNUABIM5UWIORPF5TWS5BNNB2WEL2ENFZWG5LTONUW63SDN5WW2ZLOOQXTCNZUHA3TSOBXUZZGKYLTN5XKMYLVORUG64VFMV3GK3TUVRTG633UMVZF6Y3MNFRWW#discussioncomment-17487987>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/B4XVBKNFOARJGZW4UDLEQC35CP6HVAVCNFSNUABIKJSXA33TNF2G64TZHMZDCNBVHA3TCOJTHNCGS43DOVZXG2LPNY5TCMBTGQ3TONBSUF3AE>. You are receiving this because you authored the thread.Message ID: ***@***.***>

[harrysun2006]

If you genuinely never enrolled MFA, this looks like an account/bug case rather than something you can self-serve, so it has to go through support. Reply to your ticket (SU-404571) and ask them to inspect and clear any MFA factor on the account, attaching proof of ownership (account email, project ref, org billing email, card last-4).

One sanity check while you wait: confirm you're actually landing on the intended account/org and not a second account that got created via GitHub SSO under the same email — a duplicate SSO account can look exactly like a "spurious" MFA prompt. But if it's the right account, only support can remove the factor.

[Hiddensquidgames]

Same exact symptoms here, and I want to add a data point that this may be a server-side account state issue rather than user error.

Symptoms (identical to OP):

• Sign-in method: GitHub OAuth. The OAuth handshake completes successfully every time (confirmed control of the GitHub account; SMS 2FA on the GitHub side works fine).
• After OAuth, I'm blocked at https://supabase.com/dashboard/sign-in-mfa?method=github demanding a TOTP code.
• I have no record or artifact of ever enrolling MFA on my Supabase account: no entry in any authenticator app on any device (checked current phone, previous phone, iOS Passwords, Chrome extensions, desktop apps), no recovery codes, no enrollment screenshot, no setup email. If a factor exists on this account, it exists only server-side.
• Locked out since mid-June 2026. This is a paid organization ("Hiddensquidgames's Org", ID llmttpusazjotfbprycx) and the lockout is blocking production database migrations for a live business.

What I've ruled out: clock drift (synced multiple times), stale/duplicate authenticator entries, wrong GitHub account, other browsers/profiles/sessions, and every credential-based workaround (personal access token is expired and can only be regenerated from the dashboard; database password reset requires the dashboard — every path terminates at this MFA gate).

Support ticket: #SU-402193, opened June 22, updated today with these findings. Only automated acknowledgment so far.

Supabase team: could someone check whether accounts in this state have an orphaned or unverified TOTP factor attached server-side? Requesting removal of the factor on my account with whatever ownership verification you need — I can verify via the owning GitHub account, billing email, payment details on file, and project ref qdsjusnltmoeybmzevqr.