How to fix reauthentication_needed: Reauthentication required for security-sensitive actions in Supabase

SupabaseINTERMEDIATEHIGHUpdated Dec 29, 2025· 196 views

Supabase requires reauthentication before allowing users to change their password or email address. This security measure prevents unauthorized account modifications when the Secure password change or Secure email change options are enabled.

Quick fix

Fixes reauthentication_needed: Reauthentication required for security-sensitive actions

const { data, error } = await supabase.auth.reauthenticate();
  1. Call reauthenticate() to send an OTP
  2. User receives and enters the OTP
  3. Call updateUser() with the nonce parameter
  4. Verify the operation succeeded
supabase — error
const { data, error } = await supabase.auth.reauthenticate();
reauthentication_needed: Reauthentication required for security-sensitive actions

What this error means

Supabase Auth enforces reauthentication for sensitive operations to protect user accounts from unauthorized changes. When you attempt to update a user's password or email and the Secure password change or Secure email change settings are enabled, the system requires the user to verify their identity first. This happens when a user's session is older than 24 hours or when these security features are configured. The error occurs because Supabase doesn't allow these critical changes without confirming the user's identity.

Typical symptoms

  • Password update attempts return 401 Unauthorized error
  • Email change requests fail with reauthentication_needed error
  • updateUser() calls fail when password or email parameters are provided
  • Error message states 'Password update requires reauthentication' or 'Email change requires reauthentication'
  • Operations succeed when Secure password change or Secure email change is disabled
  • Operations fail for sessions older than 24 hours even if user is logged in

Common causes

  1. Secure password change option is enabled in your Supabase project's email auth provider settings
  2. Secure email change option is enabled in your Supabase project's email auth provider settings
  3. User's current session was created more than 24 hours ago
  4. User is attempting to change password or email without recent reauthentication
  5. The reauthentication OTP nonce was not provided in the updateUser() call

How to fix "reauthentication_needed: Reauthentication required for security-sensitive actions"

1Call reauthenticate() to send an OTP

First, send a reauthentication challenge to the user. This will send an OTP (one-time password) to their confirmed email or phone number:

javascript
const { data, error } = await supabase.auth.reauthenticate();

This sends a nonce to the user's email address. If they don't have a confirmed email, it goes to their confirmed phone number instead.

2User receives and enters the OTP

The user will receive an email with a 6-digit OTP code (also called a nonce). They need to enter this code into your application's reauthentication form.

3Call updateUser() with the nonce parameter

After the user provides the OTP, use it as the nonce parameter when updating the password or email:

javascript
const { data: result, error } = await supabase.auth.updateUser({
  password: newPassword,
  nonce: otpFromEmail,
});

For email changes, include the nonce similarly:

javascript
const { data: result, error } = await supabase.auth.updateUser({
  email: newEmail,
  nonce: otpFromEmail,
});
4Verify the operation succeeded

Check for errors after the updateUser() call. If successful, the user's password or email has been updated:

javascript
if (error) {
  console.error('Update failed:', error.message);
} else {
  console.log('Update successful');
  // User is now logged out - they need to sign in again
}

Note that after a password change, the user is automatically logged out and must sign in again with the new password.

5Implement a complete reauthentication flow

For a production application, create a dedicated reauthentication modal or page:

typescript
// Step 1: Initiate reauthentication
async function startReauth() {
  const { error } = await supabase.auth.reauthenticate();
  if (error) console.error('Reauthentication failed:', error);
  // Show OTP input form to user
}

// Step 2: Submit OTP and update password
async function confirmReauthAndUpdatePassword(otp: string, newPassword: string) {
  const { data, error } = await supabase.auth.updateUser({
    password: newPassword,
    nonce: otp,
  });
  if (error) console.error('Password update failed:', error);
  else {
    console.log('Password updated. User must sign in again.');
    // Redirect to login page
  }
}

Advanced notes

By default, when a user changes their password, they are logged out and must sign in again with the new credentials. If Secure password change is disabled in your project settings, the reauthentication flow is not required, but you lose the security benefit of verifying identity before password changes. For sessions created via magic link, the reauthentication requirement may be stricter since magic link sessions don't establish traditional password authentication. The 24-hour recently-signed-in window is reset whenever a user successfully authenticates. If your application uses Multi-Factor Authentication (MFA), you may want to require reauthentication not just for password/email changes but also for other sensitive operations. Reauthentication emails use Supabase's default email template unless you customize the email templates in your project settings.

Frequently asked questions

What does "reauthentication_needed: Reauthentication required for security-sensit" mean?
Supabase Auth enforces reauthentication for sensitive operations to protect user accounts from unauthorized changes. When you attempt to update a user's password or email and the Secure password change or Secure email change settings are enabled, the system requires the user to verify their identity first. This happens when a user's session is older than 24 hours or when these security features are configured.
How do I fix "reauthentication_needed: Reauthentication required for security-sensit"?
Supabase requires reauthentication before allowing users to change their password or email address. This security measure prevents unauthorized account modifications when the Secure password change or Secure email change options are enabled.
What causes "reauthentication_needed: Reauthentication required for security-sensit"?
Secure password change option is enabled in your Supabase project's email auth provider settings Secure email change option is enabled in your Supabase project's email auth provider settings User's current session was created more than 24 hours ago
Is the "reauthentication_needed: Reauthentication required for security-sensit" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading