UnbreakMyApp / Fix guides

Google login redirects to localhost (or loops back to the login page)

After signing in with Google or a magic link, users land on localhost:3000 or bounce back to login. How to fix Supabase Site URL, redirect URLs and redirectTo.

Why it happens

Supabase sends users back to the Site URL set in Authentication → URL Configuration unless the app passes a redirectTo that is on the allowed Redirect URLs list. The default Site URL is http://localhost:3000, so a live app that never updated it sends real users to localhost.

A login loop happens when the user returns to a URL that is not allowed (Supabase falls back to the Site URL), or the page they return to does not finish exchanging the code for a session before a route guard sends them back to /login.

For Google specifically, the Authorized redirect URI in Google Cloud must be your Supabase callback URL (https://<project>.supabase.co/auth/v1/callback), not your app URL.

How to fix it, step by step

  1. In Supabase → Authentication → URL Configuration, set Site URL to your live domain, e.g. https://www.yourapp.com.
  2. Under Redirect URLs, add your live domain with a wildcard (https://www.yourapp.com/**), your preview domain (e.g. https://*.lovable.app/**), and http://localhost:3000/** for local testing.
  3. In your code, pass redirectTo: window.location.origin (or a specific /auth/callback page) to signInWithOAuth and signInWithOtp.
  4. In Google Cloud Console → Credentials → your OAuth client, make sure the Authorized redirect URI is the Supabase callback URL shown in Supabase → Authentication → Providers → Google.
  5. Make your protected-route guard wait until the session has finished loading before redirecting to /login.
  6. Test in a private window on the live domain.

Paste-ready prompt for Lovable

After Google login my app redirects to localhost (or loops back to /login). Please:
1. Find every signInWithOAuth / signInWithOtp call and pass options.redirectTo = window.location.origin + '/'.
2. Make sure the app handles the returned session (detectSessionInUrl or exchangeCodeForSession for PKCE) before any redirect.
3. Make the protected-route guard wait for the auth loading state to finish before redirecting to /login.
4. List the exact Site URL and Redirect URLs I should set in Supabase → Authentication → URL Configuration for my live and preview domains.
Do not change other features.

FAQ

Do I need to change anything in Google Cloud when I add a custom domain?

Usually not the redirect URI (it stays the Supabase callback), but you may need to add your domain to Authorized JavaScript origins and update the OAuth consent screen.

Why does it work on the preview but not on my domain?

Your custom domain is probably missing from the Redirect URLs allow list, so Supabase falls back to the Site URL.

Still broken?

Get a free diagnosis by email within 24 hours. Fixed or refunded.

Get a free diagnosis

Or get the weekly fix digest:

📬 This Week in Broken Apps: the most common Lovable/Supabase breaks and how to fix them. Free, weekly, unsubscribe anytime.

Free: the Vibe-Code Fix Checklist.

Sources