VVibeFix

Guide

Supabase redirect URL localhost: keep it for testing, send real users to your live app

You want sign-in to work on http://localhost:3000 while you build, and on your real address for everyone else. Instead, confirmation and reset emails open localhost, or sign-in lands on the wrong page. Both come from the same two settings in Supabase.

Can a stranger actually sign up and get your email? Find out which of these is breaking your app, usually in 4 to 10 minutes.

Free. No account needed. It usually takes 4 to 10 minutes.

How Site URL and Redirect URLs work

Supabase has a Site URL and a Redirect URLs allow list. The Site URL "defines the default redirect URL when no redirectTo is specified in the code", and it defaults to http://localhost:3000. Supabase's advice: "Change this from http://localhost:3000 to your production URL."

The Redirect URLs list holds every other address the app may send people back to. Supabase says the URL passed in code (redirectTo) should match that list. So localhost belongs on the list for testing, and your live address belongs in the Site URL.

The causes, and how to fix each one

Set it up in this order. Each step fixes one way people end up on localhost.

1. The Site URL is still localhost

Every email and sign-in without an explicit redirect goes to the Site URL. Left at the default, real users are sent to a localhost address that only works on your computer.

How to fix it

  1. In the Supabase dashboard, open the URL Configuration page.
  2. Set the Site URL to your live address, for example https://yourapp.com.
  3. Save.

Source: Supabase: Redirect URLs

2. Localhost and your live address are not on the Redirect URLs list

Supabase matches the list with wildcards: * matches any characters except . and /, ** matches anything. Its examples: http://localhost:3000/* matches /foo but not /foo/bar; http://localhost:3000/** matches both. For production Supabase recommends the exact redirect path.

How to fix it

  1. On the same page, add http://localhost:3000/** (use your local port) for testing.
  2. Add your live address with the exact path you redirect to, for example https://yourapp.com/auth/callback.
  3. For preview deployments, use the wildcard forms Supabase documents, such as https://*-<team-or-account-slug>.vercel.app/ for Vercel or https://--my_org.netlify.app/** for Netlify.

Source: Supabase: Redirect URLs

3. The code does not say where to return

Without a redirect in the call, Supabase uses the Site URL. A redirect you pass has to be on the Redirect URLs list.

How to fix it

  1. In sign-up, pass options: { emailRedirectTo: 'https://yourapp.com/welcome' }. Supabase says it must be on the Redirect URLs list.
  2. In Google or other social sign-in, pass options: { redirectTo: ... } to signInWithOAuth.
  3. In password reset, pass redirectTo to resetPasswordForEmail, pointing to your change-password page.
  4. Build the address from an environment value, as Supabase's example does with a site URL variable, so localhost is used only on your machine.

Source: Supabase: Redirect URLs, Supabase: Password-based auth

4. The email template ignores your redirect

If the template builds the link from {{ .SiteURL }}, the email goes to the Site URL no matter what the code passed.

How to fix it

  1. Open the Email Templates page in the Supabase dashboard.
  2. Where you use a redirect, replace {{ .SiteURL }} with {{ .RedirectTo }}, as Supabase's Redirect URLs guide says.
  3. Send yourself a new email to check the link.

Source: Supabase: Redirect URLs, Supabase: Email templates

5. Lovable apps: the settings live in Lovable

On Lovable's built-in backend, Site URL and Redirect URLs are under More, then Users, then Settings, then Advanced. Lovable says: "When you publish, Lovable sets the Site URL to your published lovable.app address," and when you connect a custom domain, "Lovable adds it to the redirect URLs." Apps that use your own Supabase project "get no automatic updates".

How to fix it

  1. Open More, then Users, then Settings, then Advanced, and check the Site URL and Redirect URLs.
  2. If sign-in works in preview but not live, add the published address or custom domain to Redirect URLs, as Lovable's troubleshooting says.
  3. If the app uses your own Supabase project, make the changes in that project's URL Configuration instead.

Source: Lovable: Authentication, Lovable: Email authentication for your app

Your AI reads your code. VibeFix signs up like a stranger. Find out which of these is breaking your app, usually in 4 to 10 minutes.

Free. No account needed. It usually takes 4 to 10 minutes.

Why you cannot see it yourself

You're signed in, your customers aren't. On your computer a localhost link may even open, so the problem looks fixed. A stranger on a phone gets "This site can't be reached" and leaves.

Frequently asked questions

Can localhost stay on the list after I go live?

The Redirect URLs list can hold several addresses, and Supabase's own examples include localhost entries for development. Keep the Site URL on your live address. For Google sign-in, Supabase advises removing http://localhost from the Google client's JavaScript origins when the app goes into production.

I set redirectTo, but the email still opens localhost. Why?

Either the address is not on the Redirect URLs list, which it has to match, or the email template still uses {{ .SiteURL }}. Check both (steps 2 and 4).

What about a mobile app?

Supabase says mobile apps can use deep link addresses, for example com.supabase://login-callback/ as the Site URL, with more on the Redirect URLs list.

Related guides

Sources (official documentation)

Fixed it? Prove a real stranger gets in

After the fix, the proof is a stranger's confirmation email opening your live app, on a phone that has never seen localhost. Your own account cannot show that, because it is not new. Your AI reads your code. VibeFix signs up like a stranger.

Free check. An AI agent signs up to your live app as a brand-new person, with a real inbox of its own, on a phone and on a computer. You get the problem count, what each problem is, and one screenshot. It never changes your app and never emails your users. Test my app, free

$9 for one app. Shows which cause is breaking your app and where, the exact fix prompt for your app for every problem, plus 3 re-checks so you can see whether the fix holds for a stranger. It does not promise a fix; it shows what the agent saw.

VibeFix is independent. Supabase, Lovable, Vercel and Netlify are trademarks of their owners.

More guides