Guide
Supabase Google sign-in sends users to localhost:3000 in production
Updated
Change the Site URL to your production URL, and add the exact production redirect path to the Redirect URLs list.
Login, emails or payments broke in your live app? Our AI agent fixes it in your code, then tests your live app again.
Fixed in your code, then tested live. Check my app free
This applies to apps that use Supabase as their backend for Google sign-in.
Why it happens
The Site URL in Supabase's URL Configuration defines the default redirect URL when no redirectTo is specified in the sign-in call. The Supabase docs tell you to change it from http://localhost:3000 to your production URL, and say this setting is critical for email confirmations and password resets.
Possible causes
- The Site URL in URL Configuration is still http://localhost:3000, so it is used as the default redirect.
- The sign-in call does not pass a redirectTo, so the Site URL is used as the default.
- If your app builds its redirect from NEXT_PUBLIC_SITE_URL, as in the Supabase example for Vercel, that variable is not set to your site URL in the production environment. In that example the code falls back to http://localhost:3000/ when no value is found.
Official fix steps
- Open the URL Configuration page in Supabase and change the Site URL from http://localhost:3000 to your production URL. (supabase.com)
- Add the necessary URLs to the Redirect URLs list, then use the URL you want users redirected to in the redirectTo parameter. (supabase.com)
- If you deploy with Vercel and use the Supabase example, set the NEXT_PUBLIC_SITE_URL environment variable to your site URL in the production environment so redirects work correctly. (supabase.com)
- In the Google Auth Platform console, add your application's URL under Authorized JavaScript origins. These should also be configured as the Site URL or redirect configuration in your Supabase project. (supabase.com)
- Remove http://localhost from the authorized origins when your application goes into production. (supabase.com)
You can't see it yourself
You're signed in, your customers aren't. Where a sign-in sends someone is decided by the project's URL settings and the sign-in call, so being signed in yourself does not show you what a customer gets when they sign in.
What to do next
App broke after you published it? Our AI agent fixes it in your code, then tests your live app again so you see the result yourself. The first check is free.
Fixed in your code, then tested live. Check my app free
Related: Supabase redirect URL goes to localhost: the fix · "Sign in with Google" fails on my live app · Login broken after publishing: loops or localhost
Sources
VibeFix's free check tries the problem you describe on your live app: tell us what broke, and our AI agent tries it and sends you a screenshot. If you want it fixed, it finds the cause, fixes it in your code and re-checks your live app.
Last checked: 3 November 2026, against the sources listed above.
VibeFix is independent. Lovable, Bolt, Replit, Base44, v0 and Supabase are trademarks of their owners.
Want it fixed?
Our AI agent fixes it in your code and tests your live app again. See pricing.
It starts with a free check that confirms the problem on your live app, no account needed.