FREE TOOL
Supabase redirect URL checker: will this redirect be allowed?
Paste your Site URL, your Redirect URLs list and the URL your app sends as
emailRedirectTo or redirectTo. The page applies the matching rules from Supabase’s
documentation and tells you whether the redirect is allowed, why people end up on the wrong page, and what to
change.
Runs in your browser. Nothing you type is sent to us or stored.
1. Your Site URL
Supabase dashboard, your project, Authentication, URL Configuration.
2. Your Redirect URLs list
Copy the list from the same page. Wildcards are checked the way Supabase documents them.
3. The redirect your app sends
If you paste an email link, the page reads the redirect_to part and ignores the rest. It never
leaves your browser, but paste it only on a page you trust, because the link contains a sign-in token. Leave this empty to see where
people land when the app sends no redirect.
4. Result
Fill in the boxes above to see the result.
Why
Problems with entries in your list
What to change
Prompt for your AI builder
This covers the code. The dashboard settings are changed by you in Supabase.
The rules this page uses
From Supabase: Redirect URLs. The separator
characters in a URL are . and /.
*matches any sequence of non-separator characters.**matches any sequence of characters.?matches any single non-separator character.\cmatches character c.[!a-z]style ranges match characters not in the range.
Supabase’s examples: http://localhost:3000/* matches /foo and /bar but
not /foo/bar or /foo/ (note the trailing slash). http://localhost:3000/**
matches /foo/bar too.
For Netlify and Vercel previews, Supabase’s page gives https://**--my_org.netlify.app/** and
https://*-<team-or-account-slug>.vercel.app/**.
FAQ
What does the Site URL do?
Supabase says the Site URL defines the default redirect URL when
no redirectTo is specified in the code. It tells you to change it from
http://localhost:3000 to your production URL, because it is critical for email confirmations and
password resets.
Why does * not match my path?
Supabase says * matches any sequence of
non-separator characters, and that the separator characters in a URL are . and /. So
https://example.com/* matches /foo but not /foo/bar. **
matches any sequence of characters.
Should I use ** in production?
Supabase says ** is useful for local development
and preview URLs, and recommends setting the exact redirect URL path for your site in production.
My redirect is allowed but the email link still opens the Site URL. Why?
Supabase says that
when you use a redirectTo option, you may need to replace {{ .SiteURL }} with
{{ .RedirectTo }} in your email templates.
Are my URLs sent to VibeFix?
No. The check runs in your browser with a script on this page.
Nothing you type is sent or stored.
Then test it as a stranger
Open your live app in a private window, sign up with a fresh email, open the link in the email and see where it lands.
VibeFix’s check covers that part: its AI agent signs up to your live app like a new person and shows whether sign-up and your pages work. It does not look inside your Supabase project or read your settings. VibeFix checks; it does not fix your app.
More: The confirmation link opens localhost and Sign-up or login broken after publishing.
This tool applies the matching rules on Supabase’s Redirect URLs page. It does not connect to your project and cannot see your real settings. Supabase may change its rules, so compare with the current docs. Last checked: 18 October 2026.
VibeFix is independent. Lovable, Bolt, Replit, Base44, v0 and Supabase are trademarks of their owners.