Guide
Password reset email opens localhost or the wrong site
Updated
A customer asks for a password reset, opens the link in the email and lands on localhost or on a site that is not yours. This applies to apps from AI builders such as Lovable, Bolt, v0 and Replit that use Supabase Auth, and it also touches apps hosted on Vercel.
Login, emails or payments broke in your live app? Our AI agent fixes it in your code, then tests your live app again.
Fixed in your code, then tested live. [Check my app free](...)
Why it happens
Supabase Auth sends people to a default address when the app's code does not say where to send them. That default is the Site URL in URL Configuration, and the Supabase docs say it starts as http://localhost:3000. The docs also call this setting critical for email confirmations and password resets.
When the code does pass a redirectTo value, the URL in redirectTo should match the Redirect URLs list configuration. Supabase's troubleshooting page says that for redirectTo to work, the exact URL must be set in the Redirect URLs setting.
The address can also come from a second place: the email template itself. The docs say that when you use a redirectTo option, you may need {{ .RedirectTo }} in the email template instead of {{ .SiteURL }}.
Possible causes
- The Site URL in Supabase is still the local default.
- The address the app sends as redirectTo does not exactly match an entry in the Redirect URLs list, for example a preview address that was never listed.
- The email template builds the link from the Site URL instead of the redirect address the app sends.
- The site address variable (NEXT_PUBLIC_SITE_URL in the Supabase docs' Vercel example) is not set to the live address in the production environment.
- The address built in code is missing https or a trailing slash, which the Supabase example code adds when it builds the address.
You can't see it yourself
You're signed in, your customers aren't. Password reset is only used by people who have forgotten their password, so you rarely receive that email yourself. A wrong link can sit there until a customer gets stuck on it.
Fixed in your code, then tested live. [Check my app free](...)
Related guides
- The confirmation link in my sign-up email opens localhost
- v0 with Supabase: sign-in sends people to the wrong URL
- Case: sign-up emails still linked to localhost although the settings looked right
Sources
- Redirect URLs | Supabase Docs
- Why am I being redirected to the wrong url when using auth redirectTo option?
Last checked: 26 October 2026, against the sources listed above.
VibeFix is independent. Lovable, Bolt, Replit, Base44, v0 and Supabase are trademarks of their owners.
Want it fixed?
Our AI agent fixes it in your code and tests your live app again. See pricing.
It starts with a free check that confirms the problem on your live app, no account needed.