---
title: "Sign-in works in preview but fails on my custom domain"
description: "Your new domain is missing from the auth provider's allowed list, or Clerk still runs on development keys. How to check each setting and fix it."
url: https://whocanfixmyapp.com/problems/auth-works-in-preview-fails-on-custom-domain
---

[Home](https://whocanfixmyapp.com/) / [Problems](https://whocanfixmyapp.com/problems) / [Sign-in and accounts](https://whocanfixmyapp.com/problems#sign-in-and-accounts)

# Sign-in works in preview but fails on my custom domain

VC-30 · Supabase · Lovable · Clerk · Updated October 2026 · By [Nathaniel Kelley](https://whocanfixmyapp.com/authors/nathaniel-kelley)

Quick verdict

Partly fixable yourself. Settings in Supabase, Lovable, or Clerk, under two hours.

- **How serious**: High
- **Fix it yourself?**: Partly, some steps need a developer
- **Typical cost**: $49–$800 one-off check, or €99–$990 for a single fix ([prices](https://whocanfixmyapp.com/pricing))
- **Top rated for Supabase**: [Redlab](https://whocanfixmyapp.com/companies/redlab) · **10.0**/10

**What you see.** Login works on the builder's preview address, but on yourdomain.com users get an error or bounce back to the sign-in page.

## Why it happens

Auth providers trust a fixed list of addresses, and your new domain is not on it. With Supabase, the **Site URL** and **Redirect URLs** under **Authentication → URL Configuration** decide where users return after email links and social sign-in, and Supabase recommends an exact redirect URL for production. Lovable adds a custom domain to the auth redirect URLs automatically when you use its built-in backend and the domain becomes Live, but if you connected your own Supabase project you must add it yourself. Google sign-in with your own credentials also needs the new redirect URL in Google Cloud Console.

Clerk is stricter. The development instance's keys do not serve a real domain. You create a production instance, swap to `pk_live_` and `sk_live_` keys, add Clerk's DNS records, supply your own OAuth credentials, and deploy certificates. Clerk notes DNS can take up to 48 hours. Each missed step shows up as a login that fails only on the custom domain.

## Fix it yourself

1. Open the failing login in a private window and read the error. A Google redirect_uri_mismatch, a Supabase link that lands on localhost, and a Clerk key error each point to a different list.
2. Supabase: open **Authentication → URL Configuration**, set **Site URL** to `https://yourdomain.com`, and add it to **Redirect URLs**. Keep the preview address too.
3. Lovable built-in backend: wait until the domain shows **Live** under **Settings → Domains**, then confirm **More → Users → Settings → Advanced** lists the domain.
4. Clerk: create a production instance in the dashboard, put the `pk_live_` and `sk_live_` keys in your host's environment variables, add the DNS records from the **Domains** page, add your own Google credentials, and click **Deploy certificates**.
5. Google sign-in: add the new callback to **Authorized redirect URIs** in Google Cloud Console (see [redirect_uri_mismatch](https://whocanfixmyapp.com/problems/google-sign-in-redirect-uri-mismatch)).
6. Redeploy or republish, then test again in a private window.

## When to get an engineer

Stop when the lists are right and it still fails, or when the app uses several providers and you cannot tell which one errors. Tell the engineer the preview address, the live domain, the auth provider, and a screenshot of the error. A one-off check at $49–$800 or a single fix at €99–$990 usually settles it in 1–2 days. If other features also break only on the live domain, read [works in preview, breaks on the live site](https://whocanfixmyapp.com/questions/works-in-preview-breaks-on-the-live-site) first.

## Top-rated companies for Supabase apps

Ranked by our score: published prices, scope of work, AI tools named, timing and a low-risk first step. [How we score](https://whocanfixmyapp.com/methodology#score).

- 1 · [Redlab](https://whocanfixmyapp.com/companies/redlab) · **10.0**/10 · Best for: A full rescue by one team that keeps building · Free first step · from $490
- 2 · [Vibe Code Rescue (Lev Arakelyan)](https://whocanfixmyapp.com/companies/vibe-code-rescue-lev-arakelyan) · **9.0**/10 · Best for: A one-off check and a cleanup · From $299
- 3 · [LazyCodeLab](https://whocanfixmyapp.com/companies/lazycodelab) · **9.0**/10 · Best for: A one-off check and a cleanup · From $399

[All 29 Supabase companies, ranked](https://whocanfixmyapp.com/best/supabase-developers)

## Check these

AUTH-01 · High

Sign-up confirmation and password reset work end to end

Use a real inbox. Check that the link arrives, points to your live domain, and works once.

AUTH-02 · High

Signing out really ends the session

Sign out, press Back, and refresh. You should not see private pages or data.

OPS-04 · Medium

Secrets live in the host's environment settings

Keys belong in environment variables on the server, not in the repository or in front-end code.

## Questions

### Why did it work on the preview URL?

The builder registered its own preview address with the auth provider when it set up sign-in. Your domain came later and nobody added it. Each provider keeps its own list.

### Can I keep using Clerk development keys on my live domain?

No. Clerk's development instance uses shared social login credentials and keys that are not meant for production. Create a production instance and use its live keys.

Sources: [Supabase: Redirect URLs](https://supabase.com/docs/guides/auth/redirect-urls); [Lovable: Custom domain](https://docs.lovable.dev/features/custom-domain); [Clerk: Deploy to production](https://clerk.com/docs/deployments/overview).

**Lovable guide**

What Lovable builds, where it breaks and how to check it: [Lovable app rescue: what breaks and how to check it](https://whocanfixmyapp.com/guides/lovable).

**Same category**

- [Users can't log in on the live site](https://whocanfixmyapp.com/problems/users-cant-log-in-on-the-live-site)
- [Google sign-in fails with redirect_uri_mismatch](https://whocanfixmyapp.com/problems/google-sign-in-redirect-uri-mismatch)
- [Confirmation and password-reset emails never arrive](https://whocanfixmyapp.com/problems/confirmation-and-password-reset-emails-never-arrive)
- [Users get logged out when they refresh the page](https://whocanfixmyapp.com/problems/users-get-logged-out-on-refresh)
- [Admin pages open to anyone with the link](https://whocanfixmyapp.com/problems/admin-pages-open-to-anyone-with-the-link)
- [Users can see each other's data](https://whocanfixmyapp.com/problems/users-can-see-each-others-data)

[All sign-in and accounts problems](https://whocanfixmyapp.com/problems#sign-in-and-accounts)

**Run every check**

The [production checklist](https://whocanfixmyapp.com/checklist) has all 24 checks with a verdict.