@Les by default, the forgot password email is sent by us. The nodejs SDK calls our API (not the core) to send the email. It goes via no-reply@supertokens.io. You can change this behaviour by overriding a function we provide in the nodeSDK.