Use Worth It's verified email flow to set a new password. A private reset link is sent to your account email; passwords are never displayed or stored by this page.

Add a time-based code from an authenticator app such as Google Authenticator, Microsoft Authenticator or 1Password. This is separate from SMS recovery.

Checking authenticator status…

Connect your authenticator app

Scan this QR code with your authenticator app. If scanning is unavailable, enter the setup key manually. Keep this key private.

Manual setup key Copy setup key

6-digit authenticator code

Verify and enable Cancel setup

Sign out other sessions if you think you left your account open on another device. This keeps this browser signed in. Access tokens on other devices can remain valid until they expire.

Security emails available from Supabase Auth cover these account changes:

• Password changed
• Email address changed
• Phone number changed
• Sign-in method linked or removed
• Authenticator / MFA method added or removed

These are project-level email notifications, not per-account switches. Failed sign-in attempts, new-device locations and session revocations are not covered by these built-in email templates.

Supabase provides seven project-level security email notification types. Worth It has not verified whether their switches are enabled or whether delivery works. Before relying on them, enable the desired notifications in Supabase, configure custom SMTP, and send a test email.