00 / guide
Supabase magic link or confirm email redirects to localhost
It worked on your computer. Now a real customer clicks the sign-in link and gets "This site can't be reached" at localhost:3000. This is a settings fix in Supabase, and it takes about five minutes.
01 / what CheckoutAlarm checks
a
What it would catch here
Nothing on this page. The broken link is inside an email, and CheckoutAlarm doesn't read email or sign in.
b
What it won't catch
It loads one page you pick with a plain request. It doesn't click links, fill in forms or run a browser. A broken sign-in link won't trigger an alert.
c
Plans
Free: 1 site, checked once a day. Pro: $19 a month, up to 3 sites checked hourly. You prove you own the site first. For Stripe we only take a restricted key with read access to Events, Webhook Endpoints and Charges. Full secret keys are refused. Compare plans
02 / fix it in the Supabase dashboard
1
Change the Site URL
Open your project, then Authentication, then URL Configuration. The Site URL is where links go when your code doesn't name a page. Change it from http://localhost:3000 to your live address, like https://yourapp.com. Supabase calls this critical for confirmation and reset emails. Supabase: redirect URLs
2
Add your live pages to Redirect URLs
On the same page, add every address your app sends people back to, such as https://yourapp.com/auth/callback. A redirectTo that isn't on this list won't be used. Supabase: allowed redirect URLs
3
Use wildcards carefully
* matches one path part and ** matches anything. So http://localhost:3000/* allows /foo but not /foo/bar. Supabase gives patterns for Vercel and Netlify previews, but suggests an exact path for your live site. Supabase: wildcards
03 / fix it in the code and the email
1
Pass the address in code
For magic links, signInWithOtp takes options.emailRedirectTo, for example https://yourapp.com/welcome. Ask your AI builder: "Set emailRedirectTo to my live URL, not localhost." Supabase: signInWithOtp
2
Read the URL from settings
Supabase's example builds the address from NEXT_PUBLIC_SITE_URL, then NEXT_PUBLIC_VERCEL_URL, then localhost as a last resort. Set NEXT_PUBLIC_SITE_URL to your live address in production. Supabase: Vercel preview URLs
3
Update the email template
When you use a redirect, you may need to swap {{ .SiteURL }} for {{ .RedirectTo }} in Authentication, Email Templates. Supabase: email templates with redirectTo
04 / test it
a
Use a new link
Request a fresh magic link after each change. Click it in a private window on your phone, not on the computer running your app.
b
Read the error in the address bar
If sign-in fails, Supabase still sends the user to the redirect URL, with the error details after a # in the address. Supabase: error handling No email at all? See our email not arriving guide.
05 / questions
- Why does my Supabase email link go to localhost:3000?
- The Site URL in URL Configuration is the default link target when your code doesn't pass a redirect. Supabase tells you to change it from http://localhost:3000 to your live address.
- I pass redirectTo but it still goes to the Site URL. Why?
- The redirect URL must match an entry in the Redirect URLs allow list. Also check the email template: with redirectTo you may need {{ .RedirectTo }} instead of {{ .SiteURL }}.
- Can I allow all my Vercel preview URLs?
- Yes. Supabase supports wildcards in the allow list and gives a pattern for Vercel previews. It suggests an exact URL for production.
06 / where CheckoutAlarm fits
CheckoutAlarm won't catch this. It doesn't read email or click sign-in links. It checks one page and your Stripe account.
CheckoutAlarm is new. It only checks sites you prove you own. How to verify
Watch my app free07 / sources
- Supabase: redirect URLs (Site URL, allow list, wildcards, templates, errors)
- Supabase: signInWithOtp (emailRedirectTo)
Docs checked on Oct 20, 2026.