aiRepoFix / How-to fixes

Lovable + Supabase login redirects to localhost (or loops) after publishing: how to fix it

Last checked against vendor documentation: October 17, 2026.

Symptoms this page covers

• The link in the sign-up or password-reset email opens http://localhost:3000 (or another localhost address).
• Login works in the preview but fails or bounces on your live domain.
• After signing in you land back on the sign-in page, or the page keeps reloading (a redirect loop).
• Google or GitHub sign-in sends you somewhere unexpected after you approve it.

Cause 1: the Site URL and Redirect URLs are wrong

Supabase Auth only sends people back to addresses you have allowed. Two settings matter:

• Site URL is the default address used when your code doesn't give one. Supabase says to change it from http://localhost:3000 to your production URL, and that it is critical for email confirmations and password resets.
• Redirect URLs is the allow list. The redirectTo your code passes has to match an entry in this list.

Lovable's own docs say the same thing from their side: if sign-in works in preview but breaks on your published app or custom domain, these URLs are usually the reason. How much Lovable does for you depends on your backend:

• Lovable Cloud (built-in backend): Lovable says it sets the Site URL to your published lovable.app address when you publish, and adds a custom domain to the redirect URLs when you connect one. A Site URL you set yourself stays as it is.
• Your own Supabase project: Lovable says there are no automatic updates, so you add the addresses in that project's auth settings yourself.

If you use Lovable's built-in backend (Cloud)

Lovable's docs say that for apps on the built-in backend, Lovable keeps the Site URL and Redirect URLs up to date for you when you publish and when you connect a custom domain. If sign-in still fails on your published app or custom domain, the address is probably missing from the list. Lovable gives two ways to fix it:

1. Ask Lovable in the project chat to add your domain to the auth redirect URLs. For example: "Add https://yourdomain.com and https://www.yourdomain.com to the auth redirect URLs."
2. Or add it yourself: open More > Cloud > Users > Auth settings, then Advanced > Redirect URLs. Lovable says this list holds up to 50 URLs, and that the Site URL (the default address used when none is given) is in the same Advanced section.

Menu names change, so if yours differ, ask Lovable in the chat where the setting is. Lovable says a Site URL you set yourself stays as you set it, so check that it isn't still a preview or localhost address. We have not tested these steps in a live Lovable project; they come from Lovable's documentation.

Fix, step by step (your own Supabase project)

1. Open your project in the Supabase dashboard and go to Authentication > URL Configuration. (Menu names change now and then. Supabase's Redirect URLs guide describes this page as the URL Configuration page.)
2. Set Site URL to your live address, for example https://yourdomain.com.
3. Under Redirect URLs, add the live address you use for sign-in, with the exact path your app returns to, for example https://yourdomain.com/ and any callback or dashboard path you pass as redirectTo.
4. Add the www version separately if people can reach it, for example https://www.yourdomain.com/. The two are different addresses. Supabase's wildcard * does not match across . or /, so don't count on a wildcard to cover it.
5. Keep http://localhost:3000/** only if you still develop locally. Supabase recommends exact paths for production rather than the broad ** pattern.
6. Save, then test (see below).

If you use Google or another provider with your own credentials, the new domain may also need a redirect URI in that provider's console (for Google, Google Cloud Console). Lovable's authentication docs mention this.

Cause 2: the redirectTo value in your code

Look for redirectTo (used with signInWithOAuth) or emailRedirectTo (used with signUp and signInWithOtp email magic links) in your code. Common problems:

• A hard-coded http://localhost:... address left in from development.
• An address that is not in the Redirect URLs list. Supabase's troubleshooting guide says the exact URL must be set in the Redirect URLs setting for redirectTo to work.
• Email templates that use {{ .SiteURL }} when you meant to use your redirectTo. Supabase's guide shows swapping to {{ .RedirectTo }} in that case.

const { data, error } = await supabase.auth.signUp({
  email,
  password,
  options: {
    emailRedirectTo: 'https://yourdomain.com/welcome'
  }
})

Using window.location.origin instead of a hard-coded address works on any domain, but every domain you use then has to be in the Redirect URLs list.

If it still loops after the settings are right

Once the URLs are correct, a loop usually comes from the code: a check that decides "not signed in" and redirects to the sign-in page before the sign-in has finished loading. Supabase's onAuthStateChange reports an INITIAL_SESSION event for exactly this; wait for it before redirecting anyone. For an example of how we explain this kind of fix, see the labeled-as-illustrative example on our homepage (it is a made-up example, not a customer).

How to test

1. Open your live domain in a private (incognito) window so no old session interferes.
2. Sign up or sign in with a test account. For email links, open the link from the email and check the address bar: it should be your live domain, not localhost.
3. You should land on your dashboard, and still be signed in after a refresh.

Sources

This page is based on the vendor documentation below. Menu names and defaults change, so check the source if something on your screen looks different.

• Supabase docs: Redirect URLs
• Supabase troubleshooting: Why am I being redirected to the wrong URL when using the redirectTo option?
• Supabase JavaScript reference: signUp (emailRedirectTo)
• Supabase JavaScript reference: signInWithOtp (emailRedirectTo)
• Supabase JavaScript reference: onAuthStateChange (INITIAL_SESSION)
• Lovable docs: Users and authentication (Site URL and redirect URLs)
• Lovable docs: Connect to Supabase

Last checked: October 17, 2026. aiRepoFix is not affiliated with or endorsed by the companies named on this page.