Internal only
Sign in
Email and password, then a TOTP code. Magic link is only for invite and password reset.
Passwords live in Supabase Auth, never in our tables or logs. No Google or SSO. No phone MFA. The session lasts 12 hours. Invite-only — no self-signup.