# 4. Deploy and establish URLs

> Redeploy with production variables, establish the canonical origin, and configure Supabase Auth redirect URLs.

# Deploy and establish URLs

Redeploy after setting the environment variables, establish the canonical HTTPS origin, and then use that exact origin in Supabase Auth.

## Produce a clean deployment

Push the intended production branch or trigger a Vercel redeployment. Confirm:

- the build uses the intended branch and commit;
- required environment variables were available to that deployment;
- the production domain resolves over HTTPS;
- the domain does not redirect to a different canonical hostname unexpectedly; and
- the login, signup, confirmation, callback, and reset-password routes resolve.

If the domain changes, update `NEXT_PUBLIC_SITE_URL` and redeploy before configuring Supabase URLs.

## Set the Site URL

In **Supabase → Authentication → URL Configuration**, set **Site URL** to the canonical production origin:

```text
https://app.example.com
```

The Site URL is Supabase's default redirect when the application does not provide `redirectTo`. It does not replace `NEXT_PUBLIC_SITE_URL`; the hosted Auth setting and application environment variable must agree.

## Add allowed redirect URLs

Add the exact routes used by Supacharger:

```text
http://localhost:3000/auth/callback
http://localhost:3000/auth/confirm

https://app.example.com/auth/callback
https://app.example.com/auth/confirm
```

If a flow supplies a query string such as `next` or `flow=recovery`, allow-list the stable route rather than copying a one-time token URL from an email. Password recovery uses `/auth/callback?flow=recovery`, so the callback entry above covers it.

Use exact production URLs. Broad wildcards are appropriate only when a controlled local or Vercel preview workflow genuinely needs them. Supabase's Vercel preview pattern is:

```text
https://*-<team-or-account-slug>.vercel.app/**
```

A wildcard permits every matching preview deployment to receive Auth redirects. Prefer a dedicated staging Supabase project when previews contain untrusted branches or production data must remain isolated.

## Social provider callback distinction

Supabase's application redirect allow-list is not the same as an OAuth provider's callback setting. For providers such as Google or GitHub:

- the application sends the user through `/auth/callback`; and
- the external provider normally returns to the Supabase Auth callback URL shown in that provider's Supabase configuration panel.

Copy the provider callback value from the current Supabase Dashboard rather than constructing it from memory.

## Completion check

- `NEXT_PUBLIC_SITE_URL`, Vercel's production domain, and Supabase Site URL use the same canonical origin.
- All enabled Auth flows have an exact local and production redirect entry.
- Preview wildcards are absent unless preview authentication is intentional.
- The deployed routes respond without a redirect loop.

Next: [Configure authentication policy](./05-authentication-policy.md).