For builders shipping this week
Login works on localhost but not on Vercel? 5 checks for Cursor-built apps
On localhost:3000 everything works: you click "Sign in with Google" or GitHub, come back logged in, and see your dashboard. On the Vercel URL, sign-in throws an error page, loops back to the login screen, or sends you to localhost. Nothing in the code changed. What changed is the environment: different variables, a different domain, and a visitor who has no cookies from your dev session.
Can a brand-new visitor sign in on your live Vercel URL? FirstUser is an AI test user for Lovable, Bolt and Cursor apps. It opens your published URL in a fresh browser, signs up with a new identity, logs in, and tells you which step failed, with a screenshot, a plain-English diagnosis and a fix prompt you can paste into Cursor. Run a free signup test — no account, no card.
Work through these in order. Most apps break on the first two.
1. Is AUTH_SECRET set in Vercel's production environment?
Auth.js (NextAuth v5) says AUTH_SECRET is the only strictly required environment variable. It encrypts cookies and tokens. In development your .env.local has it, but that file is not deployed. If Vercel's Production environment does not have it, sign-in fails on the live site.
Open Vercel → Project → Settings → Environment Variables and check that AUTH_SECRET exists for Production (and Preview, if you test there). Generate one with npx auth secret or openssl rand -base64 33.
2. Are the provider keys there too, and did you redeploy?
Your OAuth client ID and secret (AUTH_GOOGLE_ID, AUTH_GOOGLE_SECRET, AUTH_GITHUB_ID …) and your database URL need to be in Vercel as well. A common trap: you add the variable, reload the site, and nothing changes. Vercel applies new or changed environment variables only to new deployments, so redeploy after every change.
Also check anything prefixed NEXT_PUBLIC_. Next.js bakes those values into the JavaScript at build time, so a NEXT_PUBLIC_SITE_URL=http://localhost:3000 that was present during the build stays in the live bundle until you rebuild.
3. Does the OAuth app know your production callback URL?
For Next.js, Auth.js uses https://your-domain.com/api/auth/callback/[provider] by default, for example /api/auth/callback/google. If only the localhost callback is registered in Google Cloud Console or your GitHub OAuth app, the provider rejects the live login. Google shows Error 400: redirect_uri_mismatch.
Add the exact production callback, including https and the custom domain if you use one. Note that many providers (GitHub, for example) allow only one callback URL per OAuth app, so you may need a separate OAuth app for production. Auth.js also recommends separate OAuth apps for development and production when you store users in a database, so test and real users don't mix.
4. Are you testing on a preview URL?
Every Vercel preview deployment gets its own changing URL, which your OAuth provider has never heard of. Sign-in on my-app-git-feature-abc123.vercel.app can fail while production works. Auth.js supports this with AUTH_REDIRECT_PROXY_URL pointing at one stable deployment, and the same AUTH_SECRET on the stable and preview deployments. If you don't need that, test logins on the production domain only.
5. Test as a stranger, not as yourself
Your browser still holds cookies and sessions from development, and you may already be logged in on the live domain from an earlier deploy. That hides exactly the failures a new visitor hits. Open a private window, go to the production URL, and sign up with an account you have never used on the app. Then read Vercel's function logs (Project → Logs) for errors from /api/auth/* at that moment.
Or let FirstUser be the stranger
FirstUser opens your live URL in a fresh browser, signs up with a new identity, confirms the email when it can, logs in, and opens checkout. If a step fails, you get a screenshot, a plain-English diagnosis and a fix prompt you can paste into Cursor. Run a free signup test.
FAQ
Why does it work for me on the live site but not for others?
Your browser may still hold a valid session from before the break. A private window with a new account shows what a first-time visitor sees.
Do I need AUTH_URL on Vercel?
Usually not with Auth.js v5: the host is inferred from the request, and AUTH_TRUST_HOST is detected automatically on Vercel. You only need AUTH_URL for a custom base path.
My app uses Supabase Auth, not Auth.js.
Then the matching checks are the Site URL and Redirect URLs in Supabase. See Google login not working on your live site.