Google login works in preview but not on your real domain

One error, one plain-English fix you can paste into your AI tool. For apps using Supabase Auth with "Sign in with Google" (common in Lovable, Bolt, Cursor projects).
Last checked against official docs: 19 Oct 2026.

Symptom

• On your live domain, clicking "Sign in with Google" shows Error 400: redirect_uri_mismatch, or
• Google login succeeds but you land on localhost:3000 or the preview URL, or
• You come back to your site but you're not logged in.

Why it happens (plain words)

Login is a round trip through three places: your site → Google → Supabase → back to your site. Each one keeps a list of addresses it trusts. Preview works because the preview address is on those lists. Your new real domain isn't, so one of them refuses or sends the user somewhere else.

• Supabase "Site URL" is the default place users are sent back to. If it's still `http://localhost:3000`, production users get sent there.
• Supabase "Redirect URLs" is the allowlist for redirectTo. If your domain isn't listed, Supabase falls back to the Site URL.
• Google Cloud "Authorized redirect URIs" must contain your Supabase callback URL (shown on the Google provider page in Supabase), not your app's URL.
• Google "Authorized JavaScript origins" should include your app's domain.

How to confirm

1. Read the URL bar after the failed login. redirect_uri_mismatch → Google side. Landing on localhost/preview → Supabase Site URL / Redirect URLs.
2. Check your code: what is redirectTo in signInWithOAuth? Hardcoded preview/localhost URL = bug.

Step-by-step fix

1. Supabase → Authentication → URL Configuration:
   • Set Site URL to your production URL, e.g. `https://yourapp.com`.
   • Add to Redirect URLs: `https://yourapp.com/**` (or the exact callback path, which Supabase recommends for production), plus `http://localhost:3000/**` for development, and your preview pattern if needed (e.g. Vercel `https://*-<team>.vercel.app/**, Netlify https://**--<site>.netlify.app/**`).
2. Google Cloud Console → Google Auth Platform → Clients → your Web client:
   • Authorized JavaScript origins: add `https://yourapp.com` (and www. if you use it).
   • Authorized redirect URIs: must include the callback URL from Supabase's Google provider page (looks like https://<project-ref>.supabase.co/auth/v1/callback, or your Supabase custom domain).
3. In code, build redirectTo from the current site (e.g. window.location.origin + '/auth/callback') or a SITE_URL env var, never a hardcoded preview URL.
4. If you use the PKCE/SSR flow (Next.js etc.), make sure the /auth/callback route exists in production and exchanges the code for a session.
5. If email links (confirm/reset) also go to the wrong place: update email templates to use {{ .RedirectTo }} where appropriate.
6. If your Google app is in Testing mode in the Audience settings, only listed test users can sign in. Publish it for real users.

Copy-paste prompt for your AI tool

Google sign-in (Supabase Auth) works in preview but fails on my production domain https://[YOURDOMAIN].
1. Find every call to signInWithOAuth / auth redirects and show me the redirectTo values. Replace any hardcoded localhost or preview URL with one derived from window.location.origin (or a SITE_URL env variable) pointing to the correct callback route.
2. If this app uses a server callback (PKCE / @supabase/ssr), confirm the /auth/callback route exists and calls exchangeCodeForSession.
3. Then give me an exact checklist of what to set in: (a) Supabase Authentication > URL Configuration (Site URL and Redirect URLs), and (b) Google Cloud OAuth client (Authorized JavaScript origins and Authorized redirect URIs, using my Supabase callback URL). Use my real domain in the checklist.
Do not change any secrets in code.

How to verify it's fixed

• In an incognito window on the production domain: sign in with Google → you return to your production site, logged in.
• Refresh the page: still logged in.
• Try with a Google account that isn't yours (a friend's or a second account) to rule out "test users only".

Safety notes

• Don't add broad wildcards like `https://**` to Redirect URLs. Open redirects can be abused for phishing. Use exact production paths.
• Remove localhost origins from the Google client once you no longer need them (Google/Supabase docs recommend this for production).
• Never put the Google client secret in browser code. It belongs only in the Supabase provider settings.

Sources

• Supabase: Redirect URLs, https://supabase.com/docs/guides/auth/redirect-urls
• Supabase: Login with Google, https://supabase.com/docs/guides/auth/social-login/auth-google
• Google: OAuth 2.0 for web server apps (redirect URI rules), https://developers.google.com/identity/protocols/oauth2/web-server