By Partly fixable yourself. Usually a Supabase URL setting, under an hour.
What you see. Sign-in works in the builder preview, but on the published URL users see an error, a spinner, or land back on the login page.
Why it happens
Supabase Auth only sends users back to addresses it knows. The Site URL under Authentication → URL Configuration is the default destination after email confirmation and password reset, and it starts as http://localhost:3000. The Redirect URLs list holds every other address your app may use. When your live domain is missing from both, confirmation links and sign-in returns go to the wrong place and the session never lands in the user's browser.
A second cause is email confirmation. Hosted Supabase projects require it by default, and the built-in email service sends only 2 messages per hour, and only to your own team's addresses. Real users never get the link, so they cannot sign in. A third cause is keys. The live build must use the same project URL and publishable key as the preview. If the agent created a second Supabase project or swapped keys, the live site talks to an empty project.
Fix it yourself
- In Supabase, open Authentication → URL Configuration. Set Site URL to your live domain and add the domain to Redirect URLs, keeping the preview address as well.
- Open Authentication → Users and find the account that failed. If it exists but has no confirmed date, the confirmation email never arrived.
- Open the Email provider settings under Authentication and check Confirm email. Leave it on for launch, but set up custom SMTP first (see emails never arrive).
- In Lovable, check Settings → General → External Supabase points to the project you expect. In Bolt, compare the Supabase URL and publishable key in the project's environment settings with the dashboard.
- Open the live site in a private window, try to sign in, and read the red error in the browser console. Search this index for that message.
- Publish again after every settings change so the live build picks it up.
When to get an engineer
Stop if the settings are right, the user exists and is confirmed, and sign-in still fails, or if the error mentions row-level security, a 500, or an invalid key. Tell the engineer which builder you used, the live domain, whether you use Lovable Cloud or your own Supabase project, and the exact error text. A check costs $49–$800, a single fix €99–$990, usually 1–2 days. If the app also breaks in other ways on the live site, start with works in preview, breaks on the live site.
Top-rated companies for Supabase apps
Ranked by our score: published prices, scope of work, AI tools named, timing and a low-risk first step. How we score.
- 1Redlab10.0/10Best for: A full rescue by one team that keeps buildingFree first step · from $490
- 2Vibe Code Rescue (Lev Arakelyan)9.0/10Best for: A one-off check and a cleanupFrom $299
- 3LazyCodeLab9.0/10Best for: A one-off check and a cleanupFrom $399
Check these
Sign-up confirmation and password reset work end to end
Use a real inbox. Check that the link arrives, points to your live domain, and works once.
Signing out really ends the session
Sign out, press Back, and refresh. You should not see private pages or data.
Secrets live in the host's environment settings
Keys belong in environment variables on the server, not in the repository or in front-end code.
No secret keys reach the browser
Open your live app, then DevTools, Sources, and search the loaded JavaScript for sb_secret_, sk_live_, sk-proj- and sk-ant-. Older Supabase keys are long tokens starting with eyJ: decode the middle part of each on your own machine, and if it contains "role":"service_role", your secret key is public. A publishable or anon key in the browser is expected.
Questions
Why does login work in preview but not on the live site?
The preview address was added to Supabase's URL settings when the project was created. Your live domain was not. Add it to Site URL and Redirect URLs and publish again.
Should I turn off email confirmation to fix it?
Only for a quick test. Without confirmation anyone can sign up with an address they do not own. Set up custom SMTP so confirmation emails actually arrive, then keep it on.
Sources: Supabase: Redirect URLs; Supabase: Password-based auth; Supabase: Custom SMTP; Lovable: Supabase integration.