---
title: "Claude Code or Cursor app works on localhost, breaks in production"
description: "Claude Code or Cursor app works on localhost, breaks in production? The settings that never left your laptop, how to copy them to the host, what to check."
url: https://whocanfixmyapp.com/problems/claude-code-works-on-localhost-breaks-in-production
---

[Home](https://whocanfixmyapp.com/) / [Problems](https://whocanfixmyapp.com/problems) / [Deploy and go live](https://whocanfixmyapp.com/problems#deploy-and-go-live)

# Claude Code or Cursor app works on localhost, breaks in production

VC-12 · Claude Code · Updated October 2026 · By [Nathaniel Kelley](https://whocanfixmyapp.com/authors/nathaniel-kelley)

Quick verdict

Partly fixable yourself. Env vars and redirect URLs yes; code changes need a developer.

- **How serious**: High
- **Fix it yourself?**: Partly, some steps need a developer
- **Typical cost**: $49–$800 check, or €99–$990 per fix ([prices](https://whocanfixmyapp.com/pricing))
- **Top rated for Claude Code**: [Afterbuild Labs](https://whocanfixmyapp.com/companies/afterbuild-labs) · **10.0**/10

An app that works on your laptop and fails on the live server is almost always missing something the laptop had: environment variables, a redirect address, a webhook endpoint, or a database the agent set up locally and never on the host. The code is usually fine. The configuration never left your machine.

## What you see, and what it usually means

| What you see | What it usually means |
|---|---|
| Every page works locally. The live site returns a 500 error. | A secret or database URL exists in your .env.local file and not in the host's settings. |
| Sign-in works locally. Confirmation emails on the live site link to localhost. | The Site URL in Supabase still says http://localhost:3000. |
| Stripe test payments worked. Live webhooks never arrive. | The webhook endpoint points at localhost, or the signing secret is the CLI one. |
| Data you entered while building is in the live app. | The agent used the production database as its playground. |
| A deploy succeeds, then a feature that needs a key is blank. | The variable was added after the build. Changes apply only to new deployments. |

## Why it happens

Claude Code and Cursor are coding agents, not hosting platforms. They write ordinary code in your repository and run it on your machine, where the agent also created the `.env.local` file, the local database and the Stripe CLI listener. None of that is in Git, and none of it reaches your host. Next.js keeps `.env.local` out of the repository on purpose, and Vercel applies variable changes only to new deployments.

Outside services add their own localhost defaults. Supabase ships the Site URL as localhost and calls it critical for email confirmations and password resets. Stripe's CLI prints a signing secret that differs from the dashboard endpoint's secret, and a webhook endpoint must be publicly reachable over HTTPS, so a localhost address or a redirect counts as a failure. The agent tested all of this on your laptop and reported success, which was true there.

## Check these first

OPS-04 · Medium

Secrets live in the host's environment settings

Keys belong in environment variables on the server, not in the repository or in front-end code.

AUTH-01 · High

Sign-up confirmation and password reset work end to end

Use a real inbox. Check that the link arrives, points to your live domain, and works once.

DATA-02 · Critical

No secret keys reach the browser

Open your live app, then DevTools, Sources, and search the loaded JavaScript for `sb_secret_`, `sk_live_`, `sk-proj-` and `sk-ant-`. Older Supabase keys are long tokens starting with `eyJ`: decode the middle part of each on your own machine, and if it contains `"role":"service_role"`, your secret key is public. A publishable or anon key in the browser is expected.

OPS-02 · High

Testing and real users use separate databases

Experiments and AI agents should never run against production data.

PAY-01 · Critical

Paid accounts are unlocked by a verified payment webhook

Access should change only when your server receives a signed webhook from Stripe or your provider, not when the browser reaches a success page.

CODE-02 · Medium

The flows that make money have tests

Sign-up, checkout and the core action. A few end-to-end tests catch most regressions from new prompts.

## Fix it yourself

1. Open `.env.local` in the project (or `.env`) and list every variable name. In your host's settings, such as the Vercel project's Environment Variables, confirm each one exists for Production. Then redeploy, because existing deployments keep old values.
2. In Supabase, go to **Authentication → URL Configuration**. Set the Site URL to the live domain and add the live domain to Redirect URLs. Send yourself a password reset from the live site and check the link.
3. In Stripe, open **Developers → Webhooks**, add an endpoint for your live domain, copy its signing secret, and set it on the host. Look at Event deliveries after a test payment. A 3xx or 4xx response means the address or the secret is wrong.
4. Ask the agent: "Which database URL did you use while building, and is any test data in it?" If it was the live database, create a separate one for development and point the agent at it before the next session.
5. Create a `CLAUDE.md` at the project root (run `/init` in Claude Code to generate a start) with the deploy steps, the required variable names, and the rule to never run commands against production. The docs say it is loaded every session but is context, not enforcement, so use a hook for anything that must be blocked.
6. Add error monitoring so the next break reaches you before a customer. The agent cannot see production logs unless you give it access.

## When to get a human engineer

Get an engineer when the live site has been down more than a few hours, when you cannot say which secrets exist where, or when test data has mixed with real users' data. A single fix for configuration and redirect problems is €99 to $990 and about two days. If the agent worked for weeks with permission prompts off and nobody reviewed its commits, start with a one-off check at $49 to $800 over a day to a week, then the Git history review in our [Claude Code guide](https://whocanfixmyapp.com/guides/claude-code).

## Top-rated companies for Claude Code apps

Ranked by our score: published prices, scope of work, AI tools named, timing and a low-risk first step. [How we score](https://whocanfixmyapp.com/methodology#score).

- 1 · [Afterbuild Labs](https://whocanfixmyapp.com/companies/afterbuild-labs) · **10.0**/10 · Best for: A check before launch · Free first step · from $49
- 2 · [Redlab](https://whocanfixmyapp.com/companies/redlab) · **10.0**/10 · Best for: A full rescue by one team that keeps building · Free first step · from $490
- 3 · [LazyCodeLab](https://whocanfixmyapp.com/companies/lazycodelab) · **9.0**/10 · Best for: A one-off check and a cleanup · From $399

[All 27 Claude Code companies, ranked](https://whocanfixmyapp.com/best/claude-code-developers)

## Questions

### Why does my app work on localhost but not after deploying?

Because the laptop had configuration the server does not: environment variables, a local database, a localhost redirect in your auth provider, and a Stripe CLI webhook. Copy each into the host and the outside services, then redeploy.

### Can I just ask Claude Code to fix the production error?

Only if you give it the real error. Paste the host's logs or the browser console error, and tell it which variables exist on the host. Without that it will change code that was never the problem.

### What should go in CLAUDE.md?

Build and test commands, the deploy steps, the variable names the app needs, and the rules the agent must follow, such as a separate database for development. Keep it under 200 lines, and use a hook for rules that must be enforced rather than suggested.

Sources: [Claude Code docs: CLAUDE.md and memory](https://code.claude.com/docs/en/memory); [Next.js docs: Environment variables](https://nextjs.org/docs/14/pages/building-your-application/configuring/environment-variables); [Vercel docs: Environment variables](https://vercel.com/docs/environment-variables); [Supabase docs: Redirect URLs and Site URL](https://supabase.com/docs/guides/auth/redirect-urls); [Stripe docs: Manage webhook endpoints and signature errors](https://docs.stripe.com/webhooks/signature).

**Claude Code guide**

What Claude Code builds, where it breaks and how to check it: [Claude Code projects: taking over a codebase an agent wrote](https://whocanfixmyapp.com/guides/claude-code).

**Same category**

- [Lovable app not working: what breaks between preview and production](https://whocanfixmyapp.com/problems/lovable-app-not-working)
- [Base44 app not loading or stuck on Thinking: what it usually means](https://whocanfixmyapp.com/problems/base44-app-not-loading)
- [v0 app needs a backend and deployment: what to add before real users](https://whocanfixmyapp.com/problems/v0-app-needs-a-backend)
- [Lovable publish fails with a build error](https://whocanfixmyapp.com/problems/lovable-publish-failed-build-error)
- [Lovable custom domain stuck on Verifying or Setting up](https://whocanfixmyapp.com/problems/lovable-custom-domain-stuck-verifying)
- [Bolt app won't deploy to Netlify](https://whocanfixmyapp.com/problems/bolt-app-wont-deploy-to-netlify)

[All deploy and go live problems](https://whocanfixmyapp.com/problems#deploy-and-go-live)

**Run every check**

The [production checklist](https://whocanfixmyapp.com/checklist) has all 24 checks with a verdict.