For builders shipping this week
Lovable Google login not working on the live site? Check these 5 things
Google sign-in works in the Lovable editor preview, then on your published *.lovable.app address or your custom domain it loops back to the sign-in page, shows a Google error, or sends people to localhost. The code is usually fine. One of the allow lists simply doesn't know your live address yet.
Is Google sign-in actually working for a new visitor on your live URL? FirstUser is an AI test user for Lovable, Bolt and Cursor apps. It opens your published URL in a fresh browser, signs up, logs in, and tells you which step failed, with a screenshot, a plain-English diagnosis and a fix prompt you can paste into Lovable. Run a free signup test — no account, no card.
Work through the checks in order and test each one in a private window, signed out.
1. Is your live address the Site URL?
If your app uses Supabase auth, open Supabase → Authentication → URL Configuration. Supabase uses the Site URL as the default place to send people after sign-in when the app doesn't pass its own redirect. If it still says http://localhost:3000 or an old preview address, that's where users end up. Set it to the address your visitors use, for example https://yourapp.com.
2. Is every live address on the Redirect URLs list?
The Redirect URLs list is an allow list. Your app probably has more than one address: the editor preview, the published something.lovable.app address, and your custom domain (with and without www). Add each one you sign in from, for example https://yourapp.com/**. A login that "keeps me on the sign-in page" only on the custom domain is very often this.
3. Does Google know the callback?
If you use your own Google OAuth credentials, Google only returns users to redirect URIs you registered in Google Cloud Console, matched character for character. Error 400: redirect_uri_mismatch means the address Google was asked to return to is missing. Copy the redirect_uri shown on Google's error page into the OAuth client's authorized redirect URIs, save, wait a few minutes, and retry.
4. Does the app itself ask to go somewhere old?
Search the code for redirectTo (and emailRedirectTo for email signup). If a preview address or localhost is typed in, every login tries to go there. Ask Lovable to use the address the app is running on (window.location.origin) instead, and make sure that address is on your Redirect URLs list.
5. Did you publish, and does the session survive a reload?
The preview runs your latest work; visitors see the last published version. Publish after changing auth settings in code. Then sign in on the live URL and hard-refresh. If you're logged out again, or logged in but every page is empty, the problem has moved past Google: the session isn't stored, or your database rules don't let the new user read their own rows.
Paste-ready prompt for Lovable
Google sign-in works in the preview but fails on my published site [paste URL]. Check that every sign-in call uses window.location.origin (not localhost or a preview URL) for redirectTo, list every address I need to add to Supabase Site URL and Redirect URLs, and tell me if the Google OAuth client needs a new authorized redirect URI.
Test it like a first-time user
Your own browser remembers you, which hides exactly this kind of bug. FirstUser opens your published URL as a new visitor, signs up, logs in, and reports the step that broke with a screenshot and a fix prompt. Run the free signup test, or see plans for daily checks.