Supabase · api · fg-0201

Supabase OAuth or magic link ignores redirectTo and sends users to localhost or the Site URL

After Google sign-in the browser lands on http://localhost:3000 in production

Verified 2026-10-15 · Confirmed by 0 builders · Trust 50/100

Cause

Auth only honors redirectTo when the exact URL matches an entry in the Redirect URLs allow list; otherwise it falls back to the Site URL with no error.

Fix

Add every production, preview, and local callback URL to the allow list, using wildcards for preview domains, and set Site URL to production.

Apply

Dashboard: Authentication > URL Configuration > Redirect URLs
https://example.com/**
https://*-myteam.vercel.app/**
http://localhost:3000/**

Affects: Supabase Auth on all plans; email links, OAuth providers, and password reset

Sources

https://supabase.com/docs/guides/troubleshooting/why-am-i-being-redirected-to-the-wrong-url-when-using-auth-redirectto-option-_vqIeO
https://supabase.com/docs/guides/auth/redirect-urls

Have your agent know this before it fails

claude mcp add --transport http footgun https://getfootgun.com/api/mcp