Supabase login redirects to localhost:3000 after deploy

What it means in plain English

After someone signs in, confirms their email or resets a password, Supabase sends them back to a web address. By default that address is your laptop (http://localhost:3000), which only exists while you're developing. On the live site, visitors land on a dead page.

Likely causes

• The Site URL in Supabase is still http://localhost:3000 (Supabase uses it whenever your code doesn't say where to go).
• Your live domain (or Vercel/Netlify preview domain) isn't in the Redirect URLs allow list, so Supabase ignores your redirectTo and falls back to the Site URL.
• Your email templates use {{ .SiteURL }} while your code passes a different redirectTo.

How to fix it, step by step

1. Open your Supabase project, go to Authentication → URL Configuration.
2. Change Site URL from http://localhost:3000 to your real address, e.g. https://yourapp.com. Supabase calls this setting "critical for email confirmations and password resets".
3. Under Redirect URLs, add every address users should return to:
   • https://yourapp.com/**
   • For Vercel previews: https://*-<your-team>.vercel.app/**
   • For Netlify previews: https://**--<your-team>.netlify.app/**
   • Keep http://localhost:3000/** only if you still develop locally.
4. Save. No redeploy is needed for this setting.
5. If you pass redirectTo in code (Cursor/Next.js projects): make it read from an env var such as NEXT_PUBLIC_SITE_URL set to your production URL in Vercel, then redeploy.
6. Lovable/Bolt: you can ask the builder: "Make all Supabase auth redirects use window.location.origin and make sure the email confirm link uses RedirectTo." Then still do steps 1–4 in the Supabase dashboard yourself, because the AI can't change dashboard settings.
7. If you customised email templates and use redirectTo, replace {{ .SiteURL }} with {{ .RedirectTo }} in Authentication → Email Templates.

How to check it worked

• Sign up with a new email on the live site; the confirmation link should open your domain, not localhost.
• Try 'forgot password'; the reset link should point at your domain.
• If it still fails, look at the address bar after the redirect; Supabase puts error_description in the URL.

Sources

• https://supabase.com/docs/guides/auth/redirect-urls (opens in a new tab)