I'm currently relying on Supabase Auth to do the job. As soon as they support 2fa, so will Limiter. There's an ongoing ticket tracking this: https://github.com/supabase/gotrue/issues/14