---
title: "Users can't log in on the live site"
description: "Usually the live domain is missing from Supabase's Site URL and Redirect URLs, or confirmation emails never arrive. How to check each setting and fix it."
url: https://whocanfixmyapp.com/problems/users-cant-log-in-on-the-live-site
---

[Home](https://whocanfixmyapp.com/) / [Problems](https://whocanfixmyapp.com/problems) / [Sign-in and accounts](https://whocanfixmyapp.com/problems#sign-in-and-accounts)

# Users can't log in on the live site

VC-23 · Supabase · Lovable · Bolt · Updated October 2026 · By [Nathaniel Kelley](https://whocanfixmyapp.com/authors/nathaniel-kelley)

Quick verdict

Partly fixable yourself. Usually a Supabase URL setting, under an hour.

- **How serious**: High
- **Fix it yourself?**: Partly, some steps need a developer
- **Typical cost**: $49–$800 one-off check, or €99–$990 for a single fix ([prices](https://whocanfixmyapp.com/pricing))
- **Top rated for Supabase**: [Redlab](https://whocanfixmyapp.com/companies/redlab) · **10.0**/10

**What you see.** Sign-in works in the builder preview, but on the published URL users see an error, a spinner, or land back on the login page.

## Why it happens

Supabase Auth only sends users back to addresses it knows. The **Site URL** under **Authentication → URL Configuration** is the default destination after email confirmation and password reset, and it starts as `http://localhost:3000`. The **Redirect URLs** list holds every other address your app may use. When your live domain is missing from both, confirmation links and sign-in returns go to the wrong place and the session never lands in the user's browser.

A second cause is email confirmation. Hosted Supabase projects require it by default, and the built-in email service sends only 2 messages per hour, and only to your own team's addresses. Real users never get the link, so they cannot sign in. A third cause is keys. The live build must use the same project URL and publishable key as the preview. If the agent created a second Supabase project or swapped keys, the live site talks to an empty project.

## Fix it yourself

1. In Supabase, open **Authentication → URL Configuration**. Set **Site URL** to your live domain and add the domain to **Redirect URLs**, keeping the preview address as well.
2. Open **Authentication → Users** and find the account that failed. If it exists but has no confirmed date, the confirmation email never arrived.
3. Open the Email provider settings under **Authentication** and check **Confirm email**. Leave it on for launch, but set up custom SMTP first (see [emails never arrive](https://whocanfixmyapp.com/problems/confirmation-and-password-reset-emails-never-arrive)).
4. In Lovable, check **Settings → General → External Supabase** points to the project you expect. In Bolt, compare the Supabase URL and publishable key in the project's environment settings with the dashboard.
5. Open the live site in a private window, try to sign in, and read the red error in the browser console. Search this index for that message.
6. Publish again after every settings change so the live build picks it up.

## When to get an engineer

Stop if the settings are right, the user exists and is confirmed, and sign-in still fails, or if the error mentions row-level security, a 500, or an invalid key. Tell the engineer which builder you used, the live domain, whether you use Lovable Cloud or your own Supabase project, and the exact error text. A check costs $49–$800, a single fix €99–$990, usually 1–2 days. If the app also breaks in other ways on the live site, start with [works in preview, breaks on the live site](https://whocanfixmyapp.com/questions/works-in-preview-breaks-on-the-live-site).

## Top-rated companies for Supabase apps

Ranked by our score: published prices, scope of work, AI tools named, timing and a low-risk first step. [How we score](https://whocanfixmyapp.com/methodology#score).

- 1 · [Redlab](https://whocanfixmyapp.com/companies/redlab) · **10.0**/10 · Best for: A full rescue by one team that keeps building · Free first step · from $490
- 2 · [Vibe Code Rescue (Lev Arakelyan)](https://whocanfixmyapp.com/companies/vibe-code-rescue-lev-arakelyan) · **9.0**/10 · Best for: A one-off check and a cleanup · From $299
- 3 · [LazyCodeLab](https://whocanfixmyapp.com/companies/lazycodelab) · **9.0**/10 · Best for: A one-off check and a cleanup · From $399

[All 29 Supabase companies, ranked](https://whocanfixmyapp.com/best/supabase-developers)

## Check these

AUTH-01 · High

Sign-up confirmation and password reset work end to end

Use a real inbox. Check that the link arrives, points to your live domain, and works once.

AUTH-02 · High

Signing out really ends the session

Sign out, press Back, and refresh. You should not see private pages or data.

OPS-04 · Medium

Secrets live in the host's environment settings

Keys belong in environment variables on the server, not in the repository or in front-end code.

DATA-02 · Critical

No secret keys reach the browser

Open your live app, then DevTools, Sources, and search the loaded JavaScript for `sb_secret_`, `sk_live_`, `sk-proj-` and `sk-ant-`. Older Supabase keys are long tokens starting with `eyJ`: decode the middle part of each on your own machine, and if it contains `"role":"service_role"`, your secret key is public. A publishable or anon key in the browser is expected.

## Questions

### Why does login work in preview but not on the live site?

The preview address was added to Supabase's URL settings when the project was created. Your live domain was not. Add it to Site URL and Redirect URLs and publish again.

### Should I turn off email confirmation to fix it?

Only for a quick test. Without confirmation anyone can sign up with an address they do not own. Set up custom SMTP so confirmation emails actually arrive, then keep it on.

Sources: [Supabase: Redirect URLs](https://supabase.com/docs/guides/auth/redirect-urls); [Supabase: Password-based auth](https://supabase.com/docs/guides/auth/passwords); [Supabase: Custom SMTP](https://supabase.com/docs/guides/auth/auth-smtp); [Lovable: Supabase integration](https://docs.lovable.dev/integrations/supabase).

**Lovable guide**

What Lovable builds, where it breaks and how to check it: [Lovable app rescue: what breaks and how to check it](https://whocanfixmyapp.com/guides/lovable).

**Same category**

- [Google sign-in fails with redirect_uri_mismatch](https://whocanfixmyapp.com/problems/google-sign-in-redirect-uri-mismatch)
- [Confirmation and password-reset emails never arrive](https://whocanfixmyapp.com/problems/confirmation-and-password-reset-emails-never-arrive)
- [Users get logged out when they refresh the page](https://whocanfixmyapp.com/problems/users-get-logged-out-on-refresh)
- [Admin pages open to anyone with the link](https://whocanfixmyapp.com/problems/admin-pages-open-to-anyone-with-the-link)
- [Users can see each other's data](https://whocanfixmyapp.com/problems/users-can-see-each-others-data)
- [Supabase says "new row violates row-level security policy"](https://whocanfixmyapp.com/problems/supabase-rls-blocking-insert)

[All sign-in and accounts problems](https://whocanfixmyapp.com/problems#sign-in-and-accounts)

**Run every check**

The [production checklist](https://whocanfixmyapp.com/checklist) has all 24 checks with a verdict.