← All guides

Supabase login redirects to localhost or preview on your custom domain (Lovable / Bolt)

Sign-in works in preview but breaks on your published app or custom domain. Fix Supabase Site URL, redirect URLs and Google OAuth in 10 minutes.

Lovable’s own docs name this as the usual reason sign-in fails on a published app: the production URL is missing from the auth redirect URLs. Apps on Lovable Cloud get these updated automatically. If you use your own Supabase project, or you moved to Vercel, you have to add them yourself.

Symptoms

Step 1: set the Site URL

Supabase Dashboard → Authentication → URL Configuration → Site URL: https://yourdomain.com. This is the default redirect target and is used in confirmation and password-reset emails.

Step 2: add Redirect URLs

https://yourdomain.com/**
https://www.yourdomain.com/**
https://*-yourteam.vercel.app/**   # preview deployments

Step 3: stop hardcoding redirects in code

AI builders often generate a fixed preview or localhost URL. Use the current origin instead:

await supabase.auth.signInWithOAuth({
  provider: 'google',
  options: { redirectTo: `${window.location.origin}/auth/callback` },
})

Also check env-based redirects: VITE_SITE_URL=http://localhost:8080 in .env.production is just as broken as a hardcoded URL.

Step 4: Google OAuth with your own credentials

Google Cloud Console → Credentials → your OAuth client: add your domain under Authorized JavaScript origins and keep https://<project-ref>.supabase.co/auth/v1/callback as an Authorized redirect URI.

Step 5: test safely

Test in a private window, change one setting at a time, and check the auth response in the Network tab before touching code.

Rather have it fixed for you?

We take your Lovable or Bolt app live on Vercel with your domain and working login, for $39 flat. Full refund if it fails.

Get it live – $39 Security scan – $19

Sources