Deploy and establish URLs
Redeploy after setting the environment variables, establish the canonical HTTPS origin, and then use that exact origin in Supabase Auth.
Produce a clean deployment
Push the intended production branch or trigger a Vercel redeployment. Confirm:
- the build uses the intended branch and commit;
- required environment variables were available to that deployment;
- the production domain resolves over HTTPS;
- the domain does not redirect to a different canonical hostname unexpectedly; and
- the login, signup, confirmation, callback, and reset-password routes resolve.
If the domain changes, update NEXT_PUBLIC_SITE_URL and redeploy before configuring Supabase URLs.
Set the Site URL
In Supabase → Authentication → URL Configuration, set Site URL to the canonical production origin:
https://app.example.com
The Site URL is Supabase's default redirect when the application does not provide redirectTo. It does not replace NEXT_PUBLIC_SITE_URL; the hosted Auth setting and application environment variable must agree.
Add allowed redirect URLs
Add the exact routes used by Supacharger:
http://localhost:3000/auth/callback
http://localhost:3000/auth/confirm
https://app.example.com/auth/callback
https://app.example.com/auth/confirm
If a flow supplies a query string such as next or flow=recovery, allow-list the stable route rather than copying a one-time token URL from an email. Password recovery uses /auth/callback?flow=recovery, so the callback entry above covers it.
Use exact production URLs. Broad wildcards are appropriate only when a controlled local or Vercel preview workflow genuinely needs them. Supabase's Vercel preview pattern is:
https://*-<team-or-account-slug>.vercel.app/**
A wildcard permits every matching preview deployment to receive Auth redirects. Prefer a dedicated staging Supabase project when previews contain untrusted branches or production data must remain isolated.
Social provider callback distinction
Supabase's application redirect allow-list is not the same as an OAuth provider's callback setting. For providers such as Google or GitHub:
- the application sends the user through
/auth/callback; and - the external provider normally returns to the Supabase Auth callback URL shown in that provider's Supabase configuration panel.
Copy the provider callback value from the current Supabase Dashboard rather than constructing it from memory.
Completion check
NEXT_PUBLIC_SITE_URL, Vercel's production domain, and Supabase Site URL use the same canonical origin.- All enabled Auth flows have an exact local and production redirect entry.
- Preview wildcards are absent unless preview authentication is intentional.
- The deployed routes respond without a redirect loop.