Lovable browser testing vs. FirstUser: why the preview works but new users fail on the live site

Lovable’s documentation describes the preview as the live working version in the editor. It updates as you build. The published site is a snapshot that changes only when you publish. Visitors see that published URL, not the editor. Lovable’s “Open in new tab” action opens the development preview, and that URL requires a Lovable login with access to the project. A shared preview link is a separate, view-only link. Neither one is an anonymous visit to the live site.

Lovable also documents a specific auth gap: sign-in can work in the preview and fail on the published app or a custom domain when that address is missing from the project’s Site URL or redirect URLs. On the built-in backend, Lovable sets the Site URL when you publish and adds a custom domain to the redirect URLs. A Site URL you set yourself is left as you set it. If the app uses your own Supabase project, Lovable does not update those addresses for you. Email and password is the default sign-in Lovable generates. Accounts you create with Add user are confirmed automatically, which is not the same path a stranger takes through the signup form.

The preview and the published app share the same backend and data, so an account you created while clicking through the preview is a real row. The next person who opens the live URL does not have that account, those cookies, or your Lovable session. Clicking the preview is still the right way to watch a change land. It is not a test of the URL you are about to send.

FirstUser — the AI test user for Lovable, Bolt and Cursor apps — does not connect to Lovable and does not read the project chat. You paste the published URL. It opens that URL in a fresh browser, tries sign-up, email confirmation when it can see the message, login, and pricing or checkout, and saves a screenshot of each step. A failure includes a plain-English note and a fix prompt you can paste back into Lovable. It misses captchas, unusual widgets, and login that only works through another identity provider. It does not publish a failure rate for Lovable apps, and it does not replace Publish.