Get a $149 diagnosis

Error library

Symptom: auth breaks on custom domain: Supabase Auth / Clerk redirect and cookie mismatch

The auth provider is still configured for your old origin, so it redirects to localhost or sets cookies for a domain your app no longer uses. In Supabase, set the Site URL and Redirect URLs to your custom domain; in Clerk, create a production instance for that domain and add its DNS records.

Cause: Site URL / allowed redirect URLs / production domain still point at localhost or the preview domain.

How to fix it

  1. Supabase: Authentication > URL Configuration: set Site URL to https://yourdomain.com and add production redirect URLs.
  2. Pass redirectTo that matches an allowed URL (e.g. window.location.origin).
  3. Clerk: create a production instance, add your domain and the DNS records Clerk shows, and use production keys.
  4. Update OAuth provider callback URLs and redeploy with the new env vars.

Example

Illustrative example, not from a customer project.

  // Supabase sign-in
  await supabase.auth.signInWithOAuth({
    provider: 'google',
-   options: { redirectTo: 'http://localhost:3000' },
+   options: { redirectTo: `${window.location.origin}/auth/callback` },
  })

FAQ

Why localhost specifically?

Supabase falls back to the Site URL, which defaults to localhost in new projects, when redirectTo isn't an allowed URL.

Can I use Clerk development keys in production?

Clerk's docs direct you to a production instance with your own domain for launch.

Get a $149 diagnosis See pricing Still exposed or still logged out? Get an auth & database security fix (Supabase, Firebase).

$149Get a $149 diagnosis