# Supabase Auth: reauthentication_needed
> Supabase returns reauthentication_needed when updateUser changes a password with Secure password change on. Send a code with reauthenticate, pass it as nonce.
Canonical: https://app369.com/fix/supabase-reauthentication-needed/
Last updated: 2026-11-09
reauthentication_needed is the Supabase Auth error code for a password change that needs a fresh check of the user. The Auth server returns it as Password update requires reauthentication when Secure password change is on and the session is over 24 hours old.
**Short answer**
When updateUser returns this code, call supabase.auth.reauthenticate() to send a one-time code to the user’s email, or phone if there is no confirmed email. Ask for the code, then call updateUser again with the new password and the code as nonce. Users who signed in within 24 hours skip this step.
Rather not fix it yourself? [**App Fix Ticket**](https://app369.com/fixed-price/flutter-firebase-bug-fix/) starts with a fixed-price diagnosis, then a fixed price for the fix before any fix work.
## **Why Supabase asks again, and the fix**
1. 01 ### **The session is older than 24 hours**
> “A user is deemed recently signed in if the session was created in the last 24 hours.” [**Supabase docs, JavaScript reference: reauthenticate**](https://supabase.com/docs/reference/javascript/auth-reauthentication) Apps that keep users signed in across days hit this code on the change-password screen. Catch it and start the code step instead of showing a generic error.```
const { error } = await supabase.auth.updateUser({ password: newPassword });
if (error?.code === 'reauthentication_needed') {
await supabase.auth.reauthenticate();
const nonce = await askUserForCode();
await supabase.auth.updateUser({ password: newPassword, nonce });
}
```
2. 02 ### **The code is not passed back**
> “After receiving the OTP, include it as the nonce in your updateUser() call to finalize the password change.” [**Supabase docs, JavaScript reference: reauthenticate**](https://supabase.com/docs/reference/javascript/auth-reauthentication) reauthenticate only sends the code. The password change finishes only when the same code goes into updateUser as nonce.
3. 03 ### **The code was mistyped**
> “Verifying a reauthentication failed, the code is incorrect.” [**Supabase docs, Auth error codes (reauthentication_not_valid)**](https://supabase.com/docs/guides/auth/debugging/error-codes) A wrong code returns reauthentication_not_valid, a different code. Let the user ask for a new code and try again.
4. 04 ### **The setting changed between projects** Also check: Secure password change is a per-project Auth setting. A staging project without it accepts the change, and production with it on returns this code.
Checked against the vendor’s docs on November 9, 2026: [Supabase docs: Auth error codes](https://supabase.com/docs/guides/auth/debugging/error-codes); [Supabase docs: JavaScript reference, reauthenticate](https://supabase.com/docs/reference/javascript/auth-reauthentication); [Supabase Auth source: user.go (password update)](https://github.com/supabase/auth/blob/master/internal/api/user.go).
## **Rather hand it over?**
Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.
- [from $450**App Fix Ticket**One reproducible bug in an existing mobile or web app, diagnosed and fixed.**See scope and start**](https://app369.com/fixed-price/flutter-firebase-bug-fix/)
- [from $450**AI-Built App Rescue**A Lovable, Bolt or Cursor app checked end to end in 3 days, then its worst problems fixed at a fixed price.****No issues worth fixing, no charge.**** If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way. This applies to the first 10 Launch Checks bought after October 30, 2026.**See scope and start**](https://app369.com/fixed-price/ai-app-rescue/)
[**All 127 Fiverr reviews**](https://app369.com/reviews/)
Related: [**Supabase same_password**](https://app369.com/fix/supabase-same-password/) · [**Supabase weak_password**](https://app369.com/fix/supabase-auth-weak-password/) · [**Supabase mfa_verification_failed**](https://app369.com/fix/supabase-mfa-verification-failed/) · [**Supabase PGRST200**](https://app369.com/fix/supabase-could-not-find-relationship-pgrst200/)
Questions
## **More on this error**
**Does a password reset link need reauthentication? **+
Usually not. Supabase counts a user as recently signed in when the session was created in the last 24 hours, and a session created through a reset link is new.
**Where does the code go if the user has no email? **+
To the confirmed phone number. Supabase sends it to the email first and falls back to the phone.
**Can you fix it for me? **+
If one bug is the whole problem, the App Fix Ticket covers it: a written diagnosis first, then the fix. If the app has more going on, the Launch Check is a written check of the whole app. Each issue found is rated critical, high, medium or low, with where it is and how it was confirmed. No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way. This applies to the first 10 Launch Checks bought after October 30, 2026.
A different error?
## **Describe it and get a written quote**
Send the error and what you were doing. You get a written scope, a fixed price and a timeline; Simon replies by email, usually within one business day.
[**Describe your problem **→](https://app369.com/contact/) [**All fixes**](https://app369.com/fix/)