Redirected to the wrong URL after sign-in (redirectTo)

What you see

You pass a redirectTo (OAuth, password reset) or emailRedirectTo (sign-up, magic link), but after signing in the user ends up somewhere else:

• http://localhost:3000 in production
• the home page of your Site URL instead of /auth/callback
• production when you were testing on a preview deployment

Why it happens

Auth only sends users to URLs you've allowed. When the URL you pass matches neither the Site URL nor an entry in Redirect URLs, Auth ignores it and uses the Site URL. No error is shown. On SupaHost, if the Site URL was never set, it is http://localhost:3000.

How to fix it

1. Set the Site URL. Dashboard → your project → Auth tab → Auth card → Site URL. Use your production address, e.g. https://bookings.example.com.

2. Add every redirect target to Redirect URLs, one per line:

   http://localhost:3000/**
   https://bookings.example.com/**
   https://*-bookings-team.vercel.app/**
   

   Click Save Auth settings. Changes apply within about a minute.

3. Use wildcards correctly.

   • * matches characters within one part of the URL. It stops at . and /, so https://*.example.com matches https://staging.example.com but not https://a.b.example.com.
   • ** matches anything, including /. Add /** to allow every path on a host.
   • Protocol and port must match exactly: http://localhost:3000 doesn't cover http://localhost:5173 or https://localhost:3000.

4. Pass a full, absolute URL built from where the app is actually running:

   await supabase.auth.signInWithOAuth({
     provider: "github",
     options: { redirectTo: `${window.location.origin}/auth/callback` },
   });
   
   await supabase.auth.signUp({
     email,
     password,
     options: { emailRedirectTo: `${window.location.origin}/welcome` },
   });
   

   On the server there's no window; build the origin from the request or from an environment variable such as NEXT_PUBLIC_SITE_URL.

5. Check the URL Auth received. For OAuth, look at the redirect_to parameter on the /auth/v1/authorize request in your browser's network tab. For email links, hover over the button in the email; the link carries redirect_to= as well. If it's missing or different, the problem is in your code, not the allow list.

6. Mobile apps. The Redirect URLs field only accepts http:// and https:// URLs. Use an https app link or universal link, or let users enter the one-time code from the email instead of following a link.

On SupaHost

• Email links point at your project's Auth (https://app-one.acme.supahost.space/auth/v1/verify, or your custom domain), which then redirects to the allowed URL.
• The provider callback URL (https://app-one.acme.supahost.space/auth/v1/callback) is a different thing: it goes in the OAuth provider's console, not in Redirect URLs.
• Only the instance owner can change these settings.

Related

• Site URL and redirect URLs
• OAuth sign-in not redirecting on the server
• OAuth broke after adding a custom domain
• Deploying your app on Vercel