The settings looked right, but sign-up emails still went to localhost

Short answer: in our own test app, the confirmation link in real sign-up emails kept opening localhost:3000 even after the Site URL setting showed the live address. The builder's AI said the backend's sign-in service was still running with its old settings; after a backend restart, the next real sign-up landed on the live site.

This is our own test app. "Slotly Lab 3" is an app we own and use only for testing. It is not a customer's app. The bug was first spotted on 16 October 2026; the steps below happened on 17 October 2026, and we saw them once, on this one app.

What happened

1. New users who signed up got a confirmation email whose link opened http://localhost:3000: a dead end for anyone but the developer.
2. The builder's AI said it could not change that setting itself and asked the owner to set the Site URL in the backend's auth settings (in this builder: Cloud → Users → Auth settings → Advanced).
3. The owner opened that page. The Site URL field already showed the live address. The owner saved it anyway.
4. VibeFix's AI agent then signed up to the live app as a brand-new person, with a real inbox. The confirmation email still carried redirect_to=http://localhost:3000, and the link landed on localhost. A second sign-up got the same.
5. The app's own code asked for the live address (emailRedirectTo set to the live site's /welcome page), and that address was on the allowed list. The code and the settings page both said it should work.
6. We told the builder's AI that the field already showed the live address. It replied that the saved setting was correct, but the sign-in service was still running with the old address and had never reloaded. It restarted the backend.
7. Right after the restart, a new check signed up again. The new email's link redirected to the live /welcome page, and the agent landed signed in.

What fixed it

Not a code change. The code and the allowed list were the same before and after, and the live app was identical in both checks; the backend restart was the only change we saw between them.

What this means for your app

• A settings screen and a code review can both say "fixed" while real users still get the old behaviour. Only a real sign-up, reading the real email, showed the difference here.
• If you changed an auth setting (Site URL or redirect URLs) and real confirmation emails still point to the old address, ask your builder whether the backend needs a restart for the change to take effect. In our test app it did. We have seen this once, so treat it as a thing to check, not a rule.

How to check your own app

1. Open your live app in a private window, so you are signed out.
2. Sign up with an email address you have never used on the app.
3. Open the confirmation email and look at the link before you click it: where does redirect_to point?
4. Click it. You should land on your live site, signed in, not on localhost or a preview address.

Prompt to paste into your AI builder

Paste this into your AI builder: "Real sign-up confirmation emails from my live app still link to localhost, even though the Site URL in the auth settings shows my live address. Check whether the auth service is still running with old settings and whether the backend needs a restart for the saved Site URL to apply. Tell me what you will change before you change it."

Related guides

• The confirmation link in my sign-up email opens localhost: why, and the fix: the usual causes, and the settings to check first.
• Sign-up or login broken after publishing (Supabase redirect URLs): when the allowed redirect list is the problem.
• How to test your AI-built app like a real customer: the full private-window walk-through.

VibeFix's AI agent did the sign-ups in this case: it signs up to your live app like a brand-new person, reads the real confirmation email, and shows you what it saw. VibeFix checks; it does not fix your app.

Last checked: 18 October 2026, against our own lab notes for this test (16 and 17 October 2026).

VibeFix is independent. Lovable, Bolt, Replit, Base44, v0 and Supabase are trademarks of their owners.