By Partly fixable yourself. Env vars and redirect URLs yes; code changes need a developer.
- How serious
- High
- Fix it yourself?
- Partly, some steps need a developer
- Typical cost
- $49–$800 check, or €99–$990 per fix (prices)
- Top rated for Claude Code
- Afterbuild Labs · 10.0/10
An app that works on your laptop and fails on the live server is almost always missing something the laptop had: environment variables, a redirect address, a webhook endpoint, or a database the agent set up locally and never on the host. The code is usually fine. The configuration never left your machine.
What you see, and what it usually means
| What you see | What it usually means |
|---|---|
| Every page works locally. The live site returns a 500 error. | A secret or database URL exists in your .env.local file and not in the host's settings. |
| Sign-in works locally. Confirmation emails on the live site link to localhost. | The Site URL in Supabase still says http://localhost:3000. |
| Stripe test payments worked. Live webhooks never arrive. | The webhook endpoint points at localhost, or the signing secret is the CLI one. |
| Data you entered while building is in the live app. | The agent used the production database as its playground. |
| A deploy succeeds, then a feature that needs a key is blank. | The variable was added after the build. Changes apply only to new deployments. |
Why it happens
Claude Code and Cursor are coding agents, not hosting platforms. They write ordinary code in your repository and run it on your machine, where the agent also created the .env.local file, the local database and the Stripe CLI listener. None of that is in Git, and none of it reaches your host. Next.js keeps .env.local out of the repository on purpose, and Vercel applies variable changes only to new deployments.
Outside services add their own localhost defaults. Supabase ships the Site URL as localhost and calls it critical for email confirmations and password resets. Stripe's CLI prints a signing secret that differs from the dashboard endpoint's secret, and a webhook endpoint must be publicly reachable over HTTPS, so a localhost address or a redirect counts as a failure. The agent tested all of this on your laptop and reported success, which was true there.
Check these first
Secrets live in the host's environment settings
Keys belong in environment variables on the server, not in the repository or in front-end code.
Sign-up confirmation and password reset work end to end
Use a real inbox. Check that the link arrives, points to your live domain, and works once.
No secret keys reach the browser
Open your live app, then DevTools, Sources, and search the loaded JavaScript for sb_secret_, sk_live_, sk-proj- and sk-ant-. Older Supabase keys are long tokens starting with eyJ: decode the middle part of each on your own machine, and if it contains "role":"service_role", your secret key is public. A publishable or anon key in the browser is expected.
Testing and real users use separate databases
Experiments and AI agents should never run against production data.
Paid accounts are unlocked by a verified payment webhook
Access should change only when your server receives a signed webhook from Stripe or your provider, not when the browser reaches a success page.
The flows that make money have tests
Sign-up, checkout and the core action. A few end-to-end tests catch most regressions from new prompts.
Fix it yourself
- Open
.env.localin the project (or.env) and list every variable name. In your host's settings, such as the Vercel project's Environment Variables, confirm each one exists for Production. Then redeploy, because existing deployments keep old values. - In Supabase, go to Authentication → URL Configuration. Set the Site URL to the live domain and add the live domain to Redirect URLs. Send yourself a password reset from the live site and check the link.
- In Stripe, open Developers → Webhooks, add an endpoint for your live domain, copy its signing secret, and set it on the host. Look at Event deliveries after a test payment. A 3xx or 4xx response means the address or the secret is wrong.
- Ask the agent: "Which database URL did you use while building, and is any test data in it?" If it was the live database, create a separate one for development and point the agent at it before the next session.
- Create a
CLAUDE.mdat the project root (run/initin Claude Code to generate a start) with the deploy steps, the required variable names, and the rule to never run commands against production. The docs say it is loaded every session but is context, not enforcement, so use a hook for anything that must be blocked. - Add error monitoring so the next break reaches you before a customer. The agent cannot see production logs unless you give it access.
When to get a human engineer
Get an engineer when the live site has been down more than a few hours, when you cannot say which secrets exist where, or when test data has mixed with real users' data. A single fix for configuration and redirect problems is €99 to $990 and about two days. If the agent worked for weeks with permission prompts off and nobody reviewed its commits, start with a one-off check at $49 to $800 over a day to a week, then the Git history review in our Claude Code guide.
Top-rated companies for Claude Code apps
Ranked by our score: published prices, scope of work, AI tools named, timing and a low-risk first step. How we score.
- 1Afterbuild Labs10.0/10Best for: A check before launchFree first step · from $49
- 2Redlab10.0/10Best for: A full rescue by one team that keeps buildingFree first step · from $490
- 3LazyCodeLab9.0/10Best for: A one-off check and a cleanupFrom $399
Questions
Why does my app work on localhost but not after deploying?
Because the laptop had configuration the server does not: environment variables, a local database, a localhost redirect in your auth provider, and a Stripe CLI webhook. Copy each into the host and the outside services, then redeploy.
Can I just ask Claude Code to fix the production error?
Only if you give it the real error. Paste the host's logs or the browser console error, and tell it which variables exist on the host. Without that it will change code that was never the problem.
What should go in CLAUDE.md?
Build and test commands, the deploy steps, the variable names the app needs, and the rules the agent must follow, such as a separate database for development. Keep it under 200 lines, and use a hook for rules that must be enforced rather than suggested.
Sources: Claude Code docs: CLAUDE.md and memory; Next.js docs: Environment variables; Vercel docs: Environment variables; Supabase docs: Redirect URLs and Site URL; Stripe docs: Manage webhook endpoints and signature errors.