What is the difference between Site URL and Redirect URLs in Supabase?

Site URL is the default place to send users after login. Redirect URLs is the allowlist of origins that may complete auth. You need both. A missing /** or a www mismatch is enough to bounce the callback.

Is this official Lovable or Supabase documentation?

No. It is a checklist of the values that fix the custom-domain login failures that show up on r/lovable. Confirm the screens in your Supabase, Google and GitHub dashboards if they have moved.

Lovable OAuth Wizard: Fix Redirect URI Mismatch on Your Custom Domain |

Q: Why does Lovable login work on preview but fail on the custom domain?

Supabase already allows *.lovable.app. Your domain is a new origin. Add it to Site URL and Redirect URLs, and add the live origin plus the Supabase callback to Google or GitHub. Otherwise you get a 404 or Redirect URI mismatch the day you share the link.

Q: What is the Google redirect URI for a Lovable Supabase app?

https://YOUR_PROJECT_REF.supabase.co/auth/v1/callback. Not your app URL. Google sends the user to Supabase. Supabase then sends them back to a URL on your allowlist. Putting the production domain in Google’s redirect URI is the usual mismatch.

Q: Do I need localhost in Supabase redirect URLs?

Yes if you ever run the exported app locally. Lovable’s Vite default is http://localhost:5173. Add http://localhost:5173/** so local login does not break after you lock production down.

Lovable OAuth Wizard

Preview login works. The custom domain 404s. Get the exact URLs to paste into Supabase, Google and GitHub. Free, no signup. Not official Lovable docs.

Production URL Also add www (or the apex if you typed www)

Lovable preview URL (optional)

Include localhost Needed after you export to GitHub and run Vite locally.

Localhost port

Supabase project ref (optional, for Google/GitHub)

Supabase → Settings → API. The subdomain before .supabase.co. Email login does not need this.

OAuth providers

Leave both off if you only use email/password. You still need the Supabase redirect list.

Google GitHub

1. Supabase Auth → URL configuration

Site URL is the default return. Redirect URLs is the allowlist. Paste both.

Site URL

Redirect URLs

2. Google Cloud OAuth client

Authorized JavaScript origins are your app. The redirect URI is Supabase, not your domain.

Authorized JavaScript origins

Authorized redirect URI

Then paste this into Lovable

Only after the dashboards are saved. One change. Do not restyle the login form.

Then do this

How this usually breaks

Redirects, refresh, RLS and leaked keys still sink more apps than a missing Google client. Walk the rest of the list.

Open the launch checklist

Why preview login lies to you

On r/lovable the thread is always the same: Google works on *.lovable.app, then “Redirect URI mismatch” or a 404 the day the custom domain goes live. Supabase already allows the preview host. Your domain is a new origin. Nothing in the Lovable chat can add it to Google Cloud for you.

This wizard writes the allowlist. You paste it. Then you click the happy path on the real URL. Asking Lovable “does login work?” is not a test.

What to paste where

Supabase Site URL: the origin people will bookmark, usually https://yourapp.com.
Supabase Redirect URLs: every origin that may finish login, each with /**. Production, www, preview, localhost.
Google JavaScript origins: those same origins, without the path.
Google / GitHub callback: https://YOUR_PROJECT_REF.supabase.co/auth/v1/callback. Not your domain.

The callback people get wrong

Google does not send the user to https://yourapp.com/auth/callback. It sends them to Supabase. Supabase then redirects to a URL on your allowlist. If Google still has the preview callback, or your app URL, you get the mismatch. The prompt library has the “fix login on the custom domain” prompt for the client side. This page is the dashboard side.

Frequently asked questions

Why does Lovable login work on preview but fail on the custom domain?

Supabase already allows *.lovable.app. Your domain is new. Add it to Site URL, Redirect URLs, and the OAuth provider before you tweet the link.

What is the Google redirect URI for a Lovable Supabase app?

https://YOUR_PROJECT_REF.supabase.co/auth/v1/callback. Putting the production domain there is the usual mismatch.

Do I need localhost in Supabase redirect URLs?

Yes if you export to GitHub and run Vite. The default is http://localhost:5173/**.

What is the difference between Site URL and Redirect URLs?

Site URL is the default return. Redirect URLs is the allowlist. You need both. A missing /** or a www mismatch is enough to bounce.

Is this official documentation?

No. Confirm the screens in your dashboards if they have moved. It is not affiliated with Lovable, Supabase, Google or GitHub.

After auth works on the custom domain, walk the launch checklist and run the security checker. If you still need a /privacy page that names Supabase and Google, use the privacy generator.