How to fix mfa_ip_address_mismatch: MFA enrollment IP address mismatch in Supabase

SupabaseBEGINNERMEDIUMUpdated Dec 25, 2025· 125 views

The MFA enrollment process detected a different IP address during verification. This security measure prevents unauthorized factor enrollment. Complete the entire enrollment flow from the same network to resolve it.

Quick fix

Fixes mfa_ip_address_mismatch

// Clear any cached enrollment data
sessionStorage.removeItem("mfa_challenge");
sessionStorage.removeItem("mfa_secret");

// Start enrollment fresh
const { data, error } = await supabase.auth.mfa.enroll({
  factorType: "totp"
});
  1. Verify you are on the same network
  2. Clear any cached enrollment and restart
  3. Complete enrollment on the same connection
  4. Disable VPN or ensure consistent routing
supabase — error
// Clear any cached enrollment data
sessionStorage.removeItem("mfa_challenge");
sessionStorage.removeItem("mfa_secret");
// Start enrollment fresh
const { data, error } = await supabase.auth.mfa.enroll({
  factorType: "totp"
});
mfa_ip_address_mismatch: MFA enrollment IP address mismatch

What this error means

The mfa_ip_address_mismatch error occurs when a user starts the MFA enrollment process from one IP address and then attempts to complete (verify) it from a different IP address. Supabase enforces this security restriction because the MFA enrollment flow involves sensitive steps: generating a secret for TOTP or sending a verification code to a phone. Completing these steps from different IP addresses could indicate unauthorized access or an interception attack. The error message indicates that the IP addresses at enrollment start and verification completion must match.

Typical symptoms

  • MFA enrollment fails during the verify step after successfully calling enroll()
  • Error code mfa_ip_address_mismatch appears in authentication responses
  • User can generate QR code or secret but cannot verify the factor
  • VPN disconnection or network change mid-enrollment prevents completion
  • Mobile hotspot switching during enrollment process triggers the error

Common causes

  1. User started MFA enrollment on one network and completed verification on a different network
  2. VPN disconnected or reconnected to a different server during the enrollment process
  3. Mobile device switched from WiFi to cellular data (or vice versa) during factor verification
  4. User changed geographic location between enrollment start and factor verification
  5. Network proxy or gateway changed IP address during the process

How to fix "mfa_ip_address_mismatch: MFA enrollment IP address mismatch"

1Verify you are on the same network

Confirm that you are connecting from the same IP address when calling both enroll() and verify(). If you changed networks, VPN, or switched between WiFi and cellular, you need to restart the entire enrollment process from your current network.

2Clear any cached enrollment and restart

If your application cached the enrollment challenge or secret, clear it and start fresh. Call supabase.auth.mfa.enroll() again to generate a new challenge.

javascript
// Clear any cached enrollment data
sessionStorage.removeItem("mfa_challenge");
sessionStorage.removeItem("mfa_secret");

// Start enrollment fresh
const { data, error } = await supabase.auth.mfa.enroll({
  factorType: "totp"
});
3Complete enrollment on the same connection

Complete the entire enrollment flow without switching networks:

javascript
// 1. Start enrollment
const { data: enrolled } = await supabase.auth.mfa.enroll({
  factorType: "totp"
});

// 2. Display QR code and secret to user
console.log(enrolled.totp.qr_code);

// 3. User scans QR code and enters code
// 4. Verify immediately from the SAME network
const { data: verified, error } = await supabase.auth.mfa.verify({
  factorId: enrolled.id,
  code: userEnteredCode // from authenticator app
});

if (!error) {
  console.log("MFA factor activated successfully");
}
4Disable VPN or ensure consistent routing

If using a VPN, ensure it stays connected throughout the enrollment process. If the VPN is set to auto-disconnect on inactivity, disable that setting during enrollment. Alternatively, complete enrollment while on a stable home or office network without VPN.

5Use mobile data carefully

If enrolling on mobile, avoid switching between WiFi and cellular networks. If you must use mobile data, keep the same connection type throughout the process. Test on a stable WiFi network first to confirm the enrollment works.

Advanced notes

This IP-based check is a security feature in Supabase Auth to prevent man-in-the-middle attacks during MFA enrollment. The restriction applies to all factor types (TOTP, Phone). Some users report confusion when their mobile device switches networks automatically (e.g., WiFi to 4G), which can trigger this error. This is by design—Supabase cannot distinguish between a legitimate network change and an attack. If your application frequently enrolls users on mobile networks, consider documenting this behavior to users or implementing retry logic that guides them through re-enrollment if the IP address changes.

Frequently asked questions

What does "mfa_ip_address_mismatch" mean?
The mfa_ip_address_mismatch error occurs when a user starts the MFA enrollment process from one IP address and then attempts to complete (verify) it from a different IP address. Supabase enforces this security restriction because the MFA enrollment flow involves sensitive steps: generating a secret for TOTP or sending a verification code to a phone. Completing these steps from different IP addresses could indicate unauthorized access or an interception attack.
How do I fix "mfa_ip_address_mismatch"?
The MFA enrollment process detected a different IP address during verification. This security measure prevents unauthorized factor enrollment. Complete the entire enrollment flow from the same network to resolve it.
What causes "mfa_ip_address_mismatch"?
User started MFA enrollment on one network and completed verification on a different network VPN disconnected or reconnected to a different server during the enrollment process Mobile device switched from WiFi to cellular data (or vice versa) during factor verification
Is the "mfa_ip_address_mismatch" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading