Fixes › Auth

Magic link / OAuth login redirects to localhost:3000

LovableBoltv0Cursor

The error

After clicking the email link or Google login, the browser opens http://localhost:3000

Why it happens

Supabase Auth's Site URL is still set to localhost, or your production URL isn't in the Redirect URLs allow-list, so Supabase falls back to the Site URL.

How to fix it

1. Supabase → Authentication → URL Configuration: set Site URL to your production URL.
2. Add production and preview URLs to Redirect URLs (wildcards like https://*-yourteam.vercel.app/** are allowed).
3. Pass emailRedirectTo / redirectTo using window.location.origin.
4. For Google OAuth, the Google Cloud console redirect URI must be your Supabase callback URL (https://<ref>.supabase.co/auth/v1/callback).

Fix prompt (paste into Lovable, Bolt, Cursor, Replit or v0)

Supabase login redirects users to localhost after deploy. Update the auth calls to pass redirectTo/emailRedirectTo built from window.location.origin plus our callback path, add an /auth/callback route that exchanges the code for a session, and tell me exactly which Site URL and Redirect URLs to set in the Supabase dashboard for <PRODUCTION_URL>.

FAQ

Do I need to change Google Cloud settings?

Only the authorised redirect URI, which should be the Supabase callback URL, not your site.

Why localhost?

It's Supabase's default Site URL from when the project was created.

Related fixes

• Error 400: redirect_uri_mismatch (Google sign-in)
• User is logged out after page refresh
• Supabase query returns an empty array (no error)
• new row violates row-level security policy for table