Bringing a Supabase‑backed application from development to production often feels like a smooth ride—until users report login failures, missing emails, or endless redirects. Those hiccups rarely stem from buggy code; they’re almost always configuration oversights.
Supabase Auth refers to the built‑in authentication service that handles sign‑in, redirects, email verification, and session management for Supabase‑powered apps.
Understanding Supabase Auth Configuration
Supabase ships with sensible defaults for local testing, but production environments require explicit values for:
- Site URL – the base address your app uses for redirects.
- Redirect allow list – domains that Supabase may send users back to after login.
- Email provider – the service that actually delivers verification and magic‑link emails.
- Session duration – how long a JWT remains valid before a refresh is required.
Missing any of these settings will cause the exact symptoms described in the recent “Supabase Auth in Production” guide (Oct 21 2026).
Redirect URLs: The Silent Breaker
When a user signs in with a third‑party provider or a password‑less link, Supabase appends a redirectTo parameter. If the target domain isn’t on the allow list, Supabase aborts the flow and returns an error.
- Open the Supabase dashboard → Authentication → Settings.
- Locate Redirect URLs and add every production domain (e.g.,
https://app.yourcompany.com). - Ensure the Site URL field matches the primary domain, not
http://localhost:3000.
After updating, the login flow completes without the dreaded “Invalid redirect URL” message.
Email Delivery: From Test to Real Users
Supabase’s default email service routes messages to the account owner’s inbox—perfect for dev, useless for production.
- Choose a reliable SMTP provider (SendGrid, Mailgun, Amazon SES, etc.).
- In the Auth settings, replace the built‑in email configuration with your provider’s credentials.
- Verify the Sender Email domain to improve deliverability and avoid spam filters.
Once configured, users receive verification, password‑reset, and magic‑link emails reliably.
Session Settings: Keeping Users Logged In
Supabase issues JWTs with a default lifespan of 3600 seconds (1 hour). If your app expects longer sessions, you must adjust the settings.
- Navigate to Auth → Settings → Session.
- Set JWT Expiration to a value that matches your security policy (e.g., 7 days for low‑risk apps).
- Enable Refresh Token Rotation to maintain security while allowing seamless renewals.
Proper session tuning prevents unexpected logouts and reduces friction for returning users.
Quick Checklist Before Going Live
- Site URL points to the production domain, not localhost.
- All production domains are listed in the Redirect allow list.
- External SMTP provider configured and sender domain verified.
- Session expiration and refresh settings aligned with business needs.
- Audit logging enabled (see Supabase Auth Audit Logs, Oct 31 2026) to monitor authentication events.
Running through this checklist takes minutes, but it saves days of debugging in production.
Frequently Asked Questions
Why does my login redirect keep sending users back to localhost?
The Site URL is still set to http://localhost in the Supabase dashboard. Update it to your live domain and add that domain to the redirect allow list.
How can I add a new subdomain to the allowed redirects?
Go to Auth → Settings → Redirect URLs and add the subdomain (e.g., https://admin.yourcompany.com). Each entry must be an exact match.
What email service does Supabase use in production?
Supabase’s built‑in service is for development only. For production, configure an external SMTP provider such as SendGrid or Amazon SES.
Can I safely extend session lifetimes?
Yes, but pair longer JWT expiration with refresh‑token rotation and secure cookie flags to mitigate token theft risks.
Do I need to enable audit logs for authentication events?
Enabling audit logs (available as of Oct 31 2026) is recommended for security compliance and to quickly spot suspicious login patterns.
At Neptune Infotech we help you build robust, production‑ready Supabase integrations—feel free to reach out for a quick technical review.
