Your login works locally but breaks in production? Check your auth redirect URLs

You ask your AI tool to add Google sign-in. It works on localhost. You deploy, and new users click "Continue with Google," then land on an error page or get bounced back to localhost. Nobody tells you. They just leave.

This is one of the most common breakages in apps built with Lovable, Bolt, v0, Replit or Cursor, and it's almost never your code. It's configuration that lives outside your code.

Why it happens

Auth providers like Supabase, Clerk, Firebase and Google OAuth only redirect users to URLs you've approved. When you:

• move from a preview URL to a custom domain,
• add www or drop it,
• or let an AI edit change your callback route,

the URL your app asks for no longer matches the allowlist. The provider refuses, and sign-up or login silently fails.

The five-minute check

1. Find your auth provider's redirect settings. In Supabase it's Authentication, then URL Configuration. In Google Cloud it's your OAuth client's "Authorized redirect URIs."
2. Set the Site URL to your real production domain, for example https://yourapp.com, not a preview link.
3. Add every domain users actually reach: with and without www, plus any preview domain you test on.
4. Check password reset and magic-link emails too. They use the same Site URL and break the same way.
5. Test in a private window with a brand-new email, on the production domain.

If it still fails, copy the exact error from the address bar and give it to your AI tool along with your provider's redirect settings.

Catch it before your users do

Config changes like this don't show up in your code review, so they're easy to miss. FlowPatrol runs your sign-up, login and checkout flows on a schedule and emails you a ready-to-paste fix prompt the moment one breaks. Run a free scan of your app.