Confirmation and reset emails point at localhost

Symptom

Sign-up works in the builder preview. The email link opens localhost, or the production site never receives the token.

Root cause

Supabase's redirect URL guide says Site URL is the default redirect for email confirmation and password reset, and that leaving it on http://localhost:3000 breaks those emails in production. When code passes redirectTo, the email template may still use {{ .SiteURL }} instead of {{ .RedirectTo }}, so the link ignores the URL the app requested. The guide shows replacing {{ .SiteURL }} with {{ .RedirectTo }} in the confirm link.

In this project's Supabase auth settings only:

1. Set Site URL to the production origin.
2. In the confirm signup and reset password templates, point the link at {{ .RedirectTo }} when the app passes redirectTo. Keep the token_hash and type query parameters.
3. Add every real origin to the redirect allow list before you rely on RedirectTo.
4. Send yourself a confirmation email from the deployed app and open the link.

Do not put localhost in the production Site URL.

Paste this into the coding tool that has your own project open.

2-minute self-check

These steps are for an app you own. Do not run them against someone else's project.

1. In your own project, read the Site URL and the confirm-signup template.
2. Sign up on your own production domain with an inbox you control. The link host should be that domain.
3. Open the link once and confirm the session is created on the production site.

Sources

• Supabase: Redirect URLs