Use email/password or Google SSO. Email/password accounts must verify email before first login. MFA should be enforced in your Supabase auth policy.