Vibe-Code Rescue

Platform

Supabase fixes

Login sends people to localhost, empty lists, refused saves, and API keys.

17 fixes, most common first.

  1. Rank 1. Supabase login redirects to localhost:3000 after deploy

    Login or email confirm sends users to localhost:3000 on your live site? Change Supabase's Site URL and add your domain to Redirect URLs.

  2. Rank 2. Invalid API key (Supabase)

    Supabase says "Invalid API key" on your live site? Usually the key or project URL env var is missing, mistyped, or from another project.

  3. Rank 4. Supabase returns an empty array [] but the table has data

    Your Supabase query returns [] with no error even though rows exist? Row Level Security is on with no policy allowing the read.

  4. Rank 5. new row violates row-level security policy for table

    Saving data fails with "new row violates row-level security policy"? Add an INSERT policy with a WITH CHECK rule and send the right user_id.

  5. Rank 8. Blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present

    "Blocked by CORS policy" on your live site? The server you call must allow your domain. How to fix it for APIs you own and ones you don't.

  6. Rank 9. Supabase Edge Function CORS error: Response to preflight request doesn't pass access control check

    Calling a Supabase Edge Function from the browser fails with a CORS/preflight error? Handle OPTIONS and return corsHeaders on every response.

  7. Rank 14. Error 400: redirect_uri_mismatch (Sign in with Google)

    Google sign-in shows "Error 400: redirect_uri_mismatch"? The callback URL in Google Cloud must exactly match the one your app or Supabase uses.

  8. Rank 15. email rate limit exceeded (Supabase Auth)

    Supabase says "email rate limit exceeded" or sign-up emails stop? The built-in mailer allows only 2 emails an hour. Set up custom SMTP.

  9. Rank 16. Supabase confirmation or password reset email not arriving

    Users never get the Supabase confirm or reset email? Check the rate limit, set up custom SMTP and fix the link's Site URL.

  10. Rank 17. Supabase service_role or secret key exposed in front-end code

    Is your Supabase service_role or sb_secret key in your browser code? Anyone can read it and bypass all security. How to rotate and fix it.

  11. Rank 18. infinite recursion detected in policy for relation

    Supabase error 42P17 "infinite recursion detected in policy for relation"? Two RLS policies check each other. Break the loop with a function.

  12. Rank 19. permission denied for table (Supabase error 42501)

    Supabase "permission denied for table"? The role lacks a GRANT on the table, which is checked before RLS. Add the grant, then a policy.

  13. Rank 20. Supabase Storage upload fails: new row violates row-level security policy

    Image/file upload to Supabase Storage fails with an RLS error? Add policies on storage.objects for INSERT (plus SELECT/UPDATE for upsert).

  14. Rank 23. too many connections / remaining connection slots are reserved (Supabase + serverless)

    Database errors like "too many connections" after deploying to Vercel? Use Supabase's transaction pooler (port 6543) for serverless functions.

  15. Rank 31. Invalid JWT after switching to sb_publishable or sb_secret keys

    The app broke after Supabase's new sb_publishable or sb_secret keys? Legacy keys can stay on until you swap them. Don't send the new keys as a Bearer JWT.

  16. Rank 34. Supabase error: JWT expired

    API calls fail with JWT expired? The Supabase access token is meant to be short-lived. Refresh the session once, and don't refresh it twice at the same time.

  17. Rank 40. Supabase error: Email address not authorized

    Sign-up tells the user Email address not authorized? The built-in mailer only sends to your Supabase organization. Custom SMTP sends to everyone else.

All platforms

Can't fix it? Get help.

If the steps didn't clear the error, send what the screen says. A person can take a look. This is a request for a paid fix, not an instant chat.

Request a fix