Lovable authentication errors: find the right fix

What it means in plain English

An authentication error can mean several different problems. Find the row that matches what you see, then open the full fix.

What you see	Usual cause	Full fix
Sign-in works in preview, fails on the published app or custom domain	Lovable says "the published URL or custom domain is missing from your project's redirect URLs."	Sign-in fails when published
New users never get the confirmation email, or stay unconfirmed	Spam filters, or the hourly email rate limit	Confirmation emails not arriving
Google sign-in fails on your custom domain	Your own Google OAuth credentials don't have the new domain's redirect URI	Google sign-in on a custom domain
New users can't sign up at all	Disable sign-up is on, or Supabase returns signup_disabled	Supabase signup_disabled
Users get "Email not confirmed"	The account was never confirmed	Supabase email not confirmed
Users get invalid login credentials	Wrong email or password, or no such user	Supabase invalid_credentials
The Supabase view says Supabase connection issue	The connected Supabase project can't be found	Lovable Supabase connection broke

Likely causes

• The app is on Lovable's built-in backend, and a setting in More → Users → Settings needs changing.
• The app uses your own Supabase project. Lovable says those apps "get no automatic updates," so auth settings live in the Supabase dashboard.
• A sign-in method was enabled for the preview address only, or the custom domain was added later.

How to fix it, step by step

1. Find out which backend the app uses. On the built-in backend, auth settings are under More → Users → Settings. With your own Supabase project, change them in the Supabase dashboard.
2. Reproduce the error on the live address, not the preview, and note the exact message.
3. Match it to a row in the table above and follow that page.
4. For redirect problems on the built-in backend, open Advanced in the auth settings. Lovable says the Site URL is "the default URL users are redirected to after authentication," and Redirect URLs can hold "up to 50 URLs." You can also ask Lovable in the project chat to add your domain.
5. For sign-up problems, check Disable sign-up. Lovable says that when it is on, "existing users can still sign in, and you can still add users with Add user."
6. To unblock one person quickly, use Add user → Create new user in the Users view. Lovable says users created that way "are automatically confirmed."

How to check it worked

• A test account can sign up, confirm, and sign in on the published address and on the custom domain.
• The user appears in More → Users, or under Authentication in the Supabase dashboard.

Questions people ask

Where are the auth settings for a Lovable app?

On the built-in backend, click Settings in the Users view under More → Users. Apps that use your own Supabase project manage authentication in the Supabase dashboard instead.

Why does Lovable login work in preview but not after publishing?

Lovable says the published URL or custom domain is missing from your project's redirect URLs. Add it under More → Users → Settings → Advanced → Redirect URLs, or ask Lovable in the project chat to add it.

How do I stop new people from signing up to my Lovable app?

Turn on Disable sign-up in the auth settings. Lovable says existing users can still sign in, and you can still add users with Add user.

Sources

• https://docs.lovable.dev/features/authentication (opens in a new tab)
• https://docs.lovable.dev/features/email-auth (opens in a new tab)
• https://docs.lovable.dev/features/google-auth (opens in a new tab)
• https://docs.lovable.dev/integrations/supabase (opens in a new tab)