Guide
Supabase login not working on my published Lovable app (works in preview)
Updated
When sign-in works in the Lovable preview but fails on the published app or your custom domain, Lovable's documentation says the published URL or custom domain is usually missing from the project's redirect URLs. The fix is to add it: in Lovable's auth settings on the built-in backend, or in your own Supabase project's URL Configuration.
Why it happens
After sign-in, the auth service only sends people back to addresses on an approved list. The Site URL is where people go when the app names no other address. If the address your customers use is not on the list, they get an error, land on the wrong page or end up back at login.
The causes, and how to fix each
1. The published address or custom domain is missing from the redirect URLs
On Lovable's built-in backend there is a list of up to 50 redirect URLs. Lovable keeps it up to date and adds a custom domain when you connect one, but a Site URL you set yourself stays unchanged, so it is worth checking that every address people use is there.
How to fix it
- Open More, Users, click Settings, then open Advanced.
- Under Redirect URLs, add your published lovable.app address and every custom domain people use.
- Or ask Lovable in the project chat to update the URLs for your domain.
- Try signing up on the published address with a new email address.
Source: Lovable: Authentication (Site URL and redirect URLs)
2. The Site URL was set by hand and still points somewhere else
The Site URL is the default address people are sent to after sign-in when no redirect is given. Lovable sets it to your published address when you publish, but a Site URL you set yourself stays unchanged.
How to fix it
- In More, Users, Settings, Advanced, check the Site URL.
- Set it to the address your customers use (your custom domain, or the published lovable.app address).
Source: Lovable: Authentication (Site URL and redirect URLs)
3. The app uses your own Supabase project, which gets no automatic updates
Lovable says apps that use your own Supabase project get no automatic updates, so the addresses have to be added in that project. Supabase defines the Site URL as the default redirect and checks every redirect against its Redirect URLs list.
How to fix it
- In the Supabase dashboard, open Authentication, URL Configuration.
- Set the Site URL to your live address.
- Add every address people sign in from to Redirect URLs. Supabase recommends the exact address in production rather than a wildcard.
- If the app passes redirectTo when signing in, it must match an entry on that list. If your email templates use {{ .SiteURL }}, you may need {{ .RedirectTo }} instead.
Source: Lovable: Authentication (Site URL and redirect URLs) · Supabase: Redirect URLs
4. Google sign-in uses your own Google credentials
With your own Google OAuth client, every redirect address must also be listed in Google Cloud, and match exactly. After you connect a custom domain, Lovable adds its redirect URL but does not select it, so Google sign-in on the new domain fails with a redirect URI mismatch until you do. With "Managed by Lovable" nothing needs changing.
How to fix it
- In Google Cloud Console, open your OAuth client and add each redirect URI under Authorized redirect URIs. Scheme, domain, path and trailing slash must match exactly.
- In Lovable, open More, Users, Settings, Google, select the redirect URIs you added, and save.
Source: Lovable: Google authentication
5. The fix was made after the last publish
Lovable does not push later changes live automatically. A dot on the Publish button means there are changes visitors do not have yet.
How to fix it
- Click Publish, then Publish changes.
- Test again on the published address, not in the preview.
Source: Lovable: Publish your project
6. The confirmation email never arrives, so the person never gets in
If email confirmation is on and the email does not arrive, sign-up never completes and the person sees what looks like a login problem.
How to fix it
- Ask the person to check spam; Lovable says emails from new domains often land there.
- Check the project's "Rate limit for sending emails" under More, Users, Settings, Email, Advanced.
- For all causes, see the guide on confirmation emails that never arrive (linked below).
Source: Lovable: Email authentication for your app
Why you can't see it yourself
You're signed in, your customers aren't. You test in the preview, or you are already signed in, so you never go through the redirect a new person goes through on the published address.
Frequently asked questions
Why does login work in the Lovable preview but not on my published site?
Lovable says the published URL or custom domain is usually missing from the project's redirect URLs. Add it under More, Users, Settings, Advanced, or in your own Supabase project's URL Configuration.
Where do I add redirect URLs in Lovable?
On the built-in backend: More, Users, Settings, Advanced, Redirect URLs (up to 50). For your own Supabase project: Authentication, URL Configuration in the Supabase dashboard.
Do I need to change anything when I connect a custom domain?
On the built-in backend Lovable adds the domain to the redirect URLs for you. With your own Supabase project you add it yourself. With your own Google credentials you also add it in Google Cloud and select it in Lovable.
What is the Site URL in Supabase?
It is the default address people are sent to after signing in, confirming their email or resetting a password when the app names no other address. Supabase's default is localhost:3000, so it must be set to your live address.
Why does Google sign-in fail on my custom domain with a redirect URI mismatch?
The new domain's redirect URI is not yet added in Google Cloud or not selected in Lovable. Add it under Authorized redirect URIs, then select it under More, Users, Settings, Google and save.
Can VibeFix fix it for me?
Yes, if you ask. The free check confirms the problem first. Our AI agent can find the cause, fix it in your code and re-check your live app: $79 for one bug, paid up front. If we can't complete your re-check, you get your money back.
Sources (official documentation)
- Lovable: Authentication (Site URL and redirect URLs)
- Supabase: Redirect URLs
- Lovable: Google authentication
- Lovable: Publish your project
- Lovable: Email authentication for your app
Related guides
- Sign-up or login broken after publishing: users bounce back to login or land on localhost
- "Sign in with Google" fails for new people on my live app
- Google sign-in fails on my custom domain: "redirect_uri_mismatch"
- Supabase confirmation email not sending: new users never get it (Lovable, Bolt, Base44)
- The confirmation link in my sign-up email opens localhost
- New users sign up, then land back on the login page or see an error
- Lovable custom domain not working: "Action required", "Verifying" or "Unable to verify"
- Lovable publish not working: what is failing, and what a visitor sees when it "published"
- AuthApiError: Email not confirmed
- Supabase redirect URL localhost: keep it for testing, send real users to your live app
VibeFix is independent. Lovable, Supabase and Google are trademarks of their owners.
Fixed it? Prove a real stranger gets in
A fix that works from your own account proves nothing about a new customer. Your AI reads your code. VibeFix signs up like a stranger.
Free check. Paste your live app's link: an AI agent signs up to your live app once as a brand-new person ("VibeFix Test") with a real inbox of its own, on a phone and on a computer, and shows how many problems a new user still hits, what each one is, and one screenshot. No account needed. It never changes your app and never emails your users.
Want it fixed?
Our AI agent finds the cause, fixes it in your code and re-checks your live app. $79 for one bug, paid up front. If we can't complete your re-check, you get your money back.
It starts with a free check that confirms the problem on your live app, no account needed.