HMAC-SHA256 Single-Use Tokens
Password recovery tokens are cryptographically hashed, strictly time-limited to 60 minutes, and single-use to ensure bulletproof cluster access recovery.
UPDATE _supabase_control_plane.password_resets
SET used_at = NOW()
WHERE token_hash = '$token_hash' AND expires_at > NOW();