What should I check before launching a Lovable app?

Click the happy path yourself, fix auth redirect URLs, turn on RLS, scan for leaked keys, set a real title and OG image, attach a custom domain, and publish a privacy policy. Preview URLs are not a launch.

Do I need a custom domain to launch a Lovable project?

Yes if you want it to look finished. Custom domains require Lovable Pro. Sharing a preview-- URL looks like a demo and often expires.

What is the most common Lovable launch bug?

Auth and Stripe. Login works on preview, then fails on the custom domain because redirect URLs were never updated. Checkout works, then the paid feature stays locked because the webhook never hit production.

Does this checklist save my progress?

Yes, in this browser only. Nothing is sent to our servers. Reset clears the checks on this device.

Lovable Launch Checklist: Ship Without the Usual Misses |

Product & build

The chat is not the spec. Save one before you share the link.

The first prompt is a written spec Should A vague “build me an app” is the most expensive habit on r/lovable. The retry loop starts there. List pages, users, the one job, and non-goals. Generate it outside Lovable, then paste it. Prompt generator →
You clicked the happy path yourself Blocker Asking Lovable “does login work?” is not a test. It will say yes. Sign up, do the core action, refresh, come back tomorrow. Fix what you actually saw.
One change per message once it works Should Stacked “also fix X” prompts overwrite working code and burn credits. When something works, stop. Next message: one screen, one bug, no extra scope.
The project is exported to GitHub Should Long chats rot. If Lovable loses the thread, GitHub is the only backup. Connect GitHub in project settings before the last polish pass, not after a crash.

Authentication

This is where most Lovable projects die the week after launch.

Redirect URLs include production and localhost Blocker Google/Supabase login that works on preview often 404s on the custom domain. In Supabase Auth → URL config, add https://yourdomain.com/** and http://localhost:5173/**. OAuth wizard →
Sign up, login, logout and refresh all work Blocker The classic launch bug: it works until the user reloads. Create a real account, log out, log in, hard-refresh, then open the app in a private window.
OAuth providers allow the live origin Should “Redirect URI mismatch” shows up the day you leave *.lovable.app. In Google Cloud (or GitHub), add the production origin and the exact callback URL, not only the preview. OAuth wizard →
Confirmation and reset emails actually arrive Should A “check your inbox” screen with no email is a dead launch. Trigger signup and reset with your own address. If you do not need confirm, turn it off on purpose.

Payments

Checkout is easy. “Paid but not unlocked” is the expensive loop.

Live Stripe keys are only on production Blocker Test keys on the live domain, or live keys in the frontend, are how people leak charges or secrets. Preview stays test mode. Production uses live keys from Lovable env, never from a prompt.
The webhook is signed and hits the live URL Blocker Checkout can succeed while your app never hears about it. Add the production webhook in Stripe, store the signing secret, and send a test event after deploy.
A paid user keeps access after refresh Blocker “It said paid” and a locked UI is the #1 Stripe thread on r/lovable. Pay with a real test card, refresh, open a new browser, then cancel and confirm it locks again.

Security

Assume the frontend is public. Keys and open tables will be found.

No API keys or .env in the public frontend Blocker Anything shipped to the browser is public. People will grep it. Run the security checker on the production URL, not only the preview. Security checker →
RLS is on for every table with user data Blocker Default Supabase tables are readable. “It worked in preview” is not a policy. In Supabase, confirm RLS is enabled and a signed-in user cannot read another user’s rows.
Production env vars are set in Lovable Should A key that only exists in your local chat will vanish on the next publish. Open Project → Settings → Secrets and set production values after the last publish.

SEO & sharing

Default Lovable titles and missing OG images kill the first share.

The title is not “Lovable App” Should Google and iMessage show whatever is in the title tag and og:title. Defaults look unfinished. Set a unique title and meta description on the home page, then re-audit. SEO checker →
OG image and favicon survive a share Should Broken cards on X or Slack are how first users bounce. Share the production URL to yourself. Fix the image size, not only the filename. Open Graph preview →
Production is indexable Should A leftover noindex or blocked robots.txt means you launched to nobody. Check the live HTML for noindex and that /robots.txt allows Googlebot. SEO checker →
There is a real 404 page Nice Dead links to a blank Vite root look broken, not “coming soon”. Add a simple not-found route with a link home. Hit a fake URL and confirm it.

Domain

Preview URLs are not a launch. Custom domains need Pro.

The public URL is a custom domain on HTTPS Blocker Sharing preview--….lovable.app looks like a demo and often expires. Buy the domain, attach it in Lovable (Pro), wait for the padlock, then share only that URL.
www and the apex both work Should Half your users type the other one. One should 301 to the other. Open both https://domain.com and https://www.domain.com. One must redirect, both must be HTTPS.
Preview URLs are not in bios or ads Nice Old preview links keep ranking and leaking unfinished builds. Search your own brand + lovable.app and replace any public mention with the custom domain.

Email

If login or receipts depend on mail, test the inbox, not the toast.

The from-domain is verified Should Mail from onboarding@ or a Lovable default lands in spam, or not at all. Verify the domain in Resend (or your provider) and send one real message to a second inbox.
Welcome, reset or receipt emails send Should A green toast is not delivery. Trigger each template once on production. If you do not send email, turn the feature off.

Legal & trust

You are collecting data even if the app feels small.

There is a privacy policy that names the vendors Blocker Auth, Stripe and analytics are personal data even for a tiny app. Publish /privacy and list Supabase, Stripe, your email provider and analytics. Link it in the footer. Privacy generator →
There are terms if you take money Should Paid access without terms is how refunds get messy. A short /terms covering what they buy, refunds and acceptable use is enough for v1.
People can reach you Should Broken login with no email is a one-star review. Put a real address or a form in the footer. Use an inbox you actually read.

Launch day

The first week of real users is when credits disappear.

Analytics is on the production domain Should Without it you will not know if the launch landed. Add a privacy-friendly script on the custom domain only. Skip preview if you can. Recommended stack →
You opened it on a real phone Blocker Lovable’s desktop canvas hides tap targets, overflow and the iOS zoom on inputs. Use your own phone on cellular, not only the responsive toggle.
You have credits left for the first week Should Launch week is when users find the bugs. An empty balance freezes the app mid-fix. Budget a buffer above the build, or know which edits you will do in GitHub. Credit estimator →
The working spec lives outside the chat Nice You will not remember what you told it after 80 messages. Copy the last good prompt and the page list into a note or the GitHub README. Prompt generator →

Lovable Launch Checklist

Product & build

Authentication

Payments

Security

SEO & sharing

Domain

Email

Legal & trust

Launch day

Why Lovable launches fail after the first share

What “ready” actually means

The usual miss, in order

Auth breaks on the real domain

Stripe charges and the UI stays locked

Keys and tables are public

The share card still says Lovable

Frequently asked questions

What should I check before launching a Lovable app?

Do I need a custom domain?

What is the most common launch bug?

Does this checklist save my progress?

Lovable Launch Checklist

Product & build

Authentication

Payments

Security

SEO & sharing

Domain

Email

Legal & trust

Launch day

Why Lovable launches fail after the first share

What “ready” actually means

The usual miss, in order

Auth breaks on the real domain

Stripe charges and the UI stays locked

Keys and tables are public

The share card still says Lovable

Frequently asked questions

What should I check before launching a Lovable app?

Do I need a custom domain?

What is the most common launch bug?

Does this checklist save my progress?

Subscribe to our newsletter