Why it happens
An OAuth app carries an exact callback address. A new domain, or moving from preview to production, changes it, and the provider refuses anything it was not told about.
How to tell
- The provider's error page mentions redirect_uri.
- The OAuth app's callback is still configured for the old host.
- New sign-ins fail; existing sessions do not.
The fix
- Add the new callback address in the provider's OAuth app settings — Google Cloud Console credentials, or the GitHub OAuth app.
- If Supabase brokers the sign-in, the callback is Supabase's own address and it is the app's redirect list that changed: see the entry above.
- Keep both addresses configured while the move settles.
The prompt for your builder
Paste this into Lovable, Bolt, Cursor, Claude Code or whatever built the app. Replace anything in capitals. It never asks you to paste a secret into a chat; keys go into your host’s environment, by you.
Prompt for your builder
List every OAuth callback and redirect URL my app depends on — Google, GitHub, Supabase auth — and where each one is configured, then give me the exact values I need for https://YOUR-DOMAIN while keeping the current preview URL working.
How Keelnest catches it
The login journey runs after every publish, fails at the provider's redirect step, and the evidence names the step and the address it was sent to.
Know the moment this happens.
Keelnest watches your production app every five minutes and tells you in plain English what broke — with the fix. Free for your first app.