Fix guides / Login redirects to localhost after deploy

Supabase login sends users to localhost after you deploy

Users click the login link in their email, or finish Google sign-in, and land on localhost:3000 with an error page. The fix is two settings and one line of code.

Why it happens

Supabase sends users back to the Site URL set in your project, unless your code asks for another address that is on the Redirect URLs allow list. New projects default the Site URL to http://localhost:3000.

Step 1: set the Site URL

Supabase dashboard, Authentication, URL Configuration. Set Site URL to your live address, for example https://myapp.com.

Step 2: add redirect URLs

In the same screen add every place users may return to:

https://myapp.com/**
https://*-yourteam.vercel.app/**
http://localhost:5173/**

The wildcard entries cover Vercel preview deployments and local development.

Step 3: pass the redirect in code

await supabase.auth.signInWithOtp({
  email,
  options: { emailRedirectTo: `${window.location.origin}/auth/callback` }
});

await supabase.auth.signInWithOAuth({
  provider: 'google',
  options: { redirectTo: `${window.location.origin}/auth/callback` }
});

Using window.location.origin means the same code works locally and in production.

Step 4 (Google login): check the Google console

In Google Cloud Console, the OAuth client's authorized redirect URI must be your Supabase callback, https://YOUR-PROJECT.supabase.co/auth/v1/callback, not your app URL.

Still looping?

If users come back but are not logged in, the callback page may not be exchanging the code for a session. With the PKCE flow, the /auth/callback route must call supabase.auth.exchangeCodeForSession(code) (Supabase's SSR helpers do this for you if configured).

Last updated 2026-10-19.