What about the users who already got a localhost link?

Their links still point at localhost, because the address is written into each email when it’s sent. Fix the settings, then have them request a new confirmation or reset email.

Should I just use window.location.origin as the redirect?

It works on every deploy, including previews, as long as each origin is on the Redirect URLs allow list. Supabase recommends exact URLs in production, so list the production one exactly and use wildcards only for previews and local development.

Local development broke after I changed the Site URL. Why?

Local sign-ins now redirect to the live site by default. Add your local address, such as http://localhost:3000/**, to the Redirect URLs allow list and pass it as the redirect from your local code.

Can you fix it for me?

If one bug is the whole problem, the App Fix Ticket covers it: a written diagnosis first, then the fix. If the app has more going on, the Launch Check is a written check of the whole app. Each issue found is rated critical, high, medium or low, with where it is and how it was confirmed. No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way.

Supabase Auth Emails Link to Localhost? Fix

Short answer

Change the Site URL in Supabase under Authentication, URL Configuration, from http://localhost:3000 to your live address. Supabase uses it when your code doesn’t pass a redirect URL. If your code does pass one, that exact URL must also be on the Redirect URLs allow list.

The three places to check

01
The Site URL is still localhost
The Site URL is the default address in auth emails when your code passes no redirect. Supabase’s docs say to change it from http://localhost:3000 to your production URL. Emails already sent keep their old link, so do this before launch.
02
The redirect URL isn’t on the allow list
When your code passes emailRedirectTo to signUp, or redirectTo to resetPasswordForEmail, that URL has to match an entry in the Redirect URLs allow list. Add your production URLs there. For Netlify or Vercel preview deploys, Supabase’s docs show wildcard entries; use exact paths for production. Also search your code for localhost: generated sign-up code often hardcodes it in emailRedirectTo or redirectTo.
```
await supabase.auth.signUp({
  email,
  password,
  options: { emailRedirectTo: 'https://yourapp.com/welcome' },
});
```
03
A custom email template uses {{ .SiteURL }}
If you edited the email templates and built the link from {{ .SiteURL }}, the email ignores the redirect your code passes. Use {{ .ConfirmationURL }}, which already carries your redirect. If you build a custom link, use {{ .RedirectTo }} for the destination together with {{ .TokenHash }} and a page that verifies it, as the email templates docs show.

Checked against the vendor’s docs on October 30, 2026: Supabase docs: Redirect URLs; Supabase docs: Email templates; Supabase reference: signUp; Supabase reference: resetPasswordForEmail.

Rather hand it over?

Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.

Supabase Auth email bugSupabase confirmation and reset emails link to localhost:3000

The three places to check

The Site URL is still localhost

The redirect URL isn’t on the allow list

A custom email template uses {{ .SiteURL }}

Rather hand it over?

More on this error

Describe it and get a written quote