Guide
The password reset email opens localhost or the wrong site
A customer asks for a password reset, opens the link in the email, and lands on localhost or a site that is not yours. This applies to apps from AI builders that use Supabase Auth.
Find out in 2 minutes which of these is breaking your app. Test my app, free
Why it happens
When your code does not say where to send people, Supabase sends them to its Site URL, which starts as a local address. When the code does say, that address has to match an approved list exactly.
Possible causes
- The Site URL in Supabase is still the local default.
- The address the app sends does not exactly match an entry in the Redirect URLs list.
- The email template builds the link from the Site URL instead of the redirect address the app sends.
- Preview or branch addresses were never added to the approved list.
- The site address variable is not set in the production environment.
- The address built in code is missing https, or differs by a trailing slash from the approved entry.
You can't see it yourself
You're signed in, your customers aren't. You are signed in, and password reset is only used by customers who have forgotten their password. You rarely receive that email yourself.
Find out in 2 minutes which of these is breaking your app. Test my app, free
Related: The confirmation link in my sign-up email opens localhost · Sign-up or login broken after publishing: users bounce back to login or land on localhost · v0 with Supabase: sign-in sends people to the wrong URL
VibeFix is independent. Lovable, Bolt, Replit, Base44, v0, Supabase, Clerk and Vercel are trademarks of their owners.
Still stuck?
Paste your app’s link for a free sign-up check, no account needed. An AI agent signs up to your live app as a brand-new person, on a phone and a computer, and tells you whether a new person can finish.