Why it happens
Supabase Auth only redirects to addresses on its allow-list, and the list still holds the old preview address. Login fails on your new domain because the redirect URL is missing in Supabase.
How to tell
- The login journey fails at the redirect step, on every run.
- Supabase › Authentication › URL Configuration: the new domain is missing from Redirect URLs and the Site URL is still the old one.
- The deploy that added the custom domain, minutes before the first failure.
The fix
- In Supabase › Authentication › URL Configuration, add https://your-domain/** to Redirect URLs and set the Site URL to the new domain.
- Keep the old address on the list for a week, so links already sent still land.
- Run the login journey again; it should pass within two minutes.
Where to look
The prompt for your builder
Paste this into Lovable, Bolt, Cursor, Claude Code or whatever built the app. Replace anything in capitals. It never asks you to paste a secret into a chat; keys go into your host’s environment, by you.
My app moved to the custom domain https://YOUR-DOMAIN. Update the Supabase auth configuration: add https://YOUR-DOMAIN/** to the Redirect URLs and set the Site URL to https://YOUR-DOMAIN, keeping the existing preview URL on the list. Then find every place in the code that still hardcodes the old address.
How Keelnest catches it
Publish Verification runs the login journey within five minutes of the deploy that introduced the domain and reads Supabase's URL configuration as evidence, so the incident names the missing entry and the fix is one line in one place.
Know the moment this happens.
Keelnest watches your production app every five minutes and tells you in plain English what broke — with the fix. Free for your first app.