What is localhost?

An address that always means 'this computer'. It works on your laptop and nowhere else.

Where localhost goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

The life of a click · 4 minutes · Pro
Confirm email, reach localhost
Your first real user signs up and clicks the confirmation link. Their browser says 'This site can't be reached: localhost'.
Why does my email link go to localhost?
Your auth provider's Site URL or redirect setting still points at your development address, so production users are sent to localhost, which only exists on your computer. Set the Site URL to your real domain and add each environment's exact callback URL to the allowed redirect list.
Read the fix
Launch day · 4 minutes · Pro
Sign in with Google: Error 400
'Sign in with Google' works perfectly on your laptop. On your real domain, users see 'Error 400: redirect_uri_mismatch'.
How do I fix Google redirect_uri_mismatch?
Add the exact callback URL your app uses in production to the allowed redirect URIs in Google Cloud Console and in your auth provider. It must match exactly, including https, domain, path and trailing slash. Google does not allow wildcards, so give each environment that needs sign-in a stable address.
Read the fix
Don't trust the browser · 4 minutes · Pro
The curious link preview
Your app shows a preview card when someone pastes a link. A user pasted an odd address, and the preview showed your server's cloud credentials.
What is SSRF in a link preview feature?
Server-side request forgery happens when your server fetches a URL a visitor provides, and the visitor points it at internal addresses such as localhost, private networks or the cloud metadata address 169.254.169.254. Allow only http and https, resolve the address and refuse internal ranges, limit redirects, time and size, and return only the title and image.
Read the fix

Production: The real, live version of your app that customers use, as opposed to the copy on your laptop.
Authentication: Checking who someone is, usually by signing in.
OAuth: The 'Sign in with Google' system. Google sends people back to your app only at addresses you registered.
Request: A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.
Response: The server's reply to a request: the data, plus a status code saying whether it worked.
Server: A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.

All 62 terms in the glossary

Where localhost goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

The life of a click · 4 minutes · Pro

Confirm email, reach localhost

Your first real user signs up and clicks the confirmation link. Their browser says 'This site can't be reached: localhost'.

Why does my email link go to localhost?

Your auth provider's Site URL or redirect setting still points at your development address, so production users are sent to localhost, which only exists on your computer. Set the Site URL to your real domain and add each environment's exact callback URL to the allowed redirect list.

Read the fix

Launch day · 4 minutes · Pro

Sign in with Google: Error 400

'Sign in with Google' works perfectly on your laptop. On your real domain, users see 'Error 400: redirect_uri_mismatch'.

How do I fix Google redirect_uri_mismatch?

Add the exact callback URL your app uses in production to the allowed redirect URIs in Google Cloud Console and in your auth provider. It must match exactly, including https, domain, path and trailing slash. Google does not allow wildcards, so give each environment that needs sign-in a stable address.

Read the fix

Don't trust the browser · 4 minutes · Pro

The curious link preview

Your app shows a preview card when someone pastes a link. A user pasted an odd address, and the preview showed your server's cloud credentials.

What is SSRF in a link preview feature?

Server-side request forgery happens when your server fetches a URL a visitor provides, and the visitor points it at internal addresses such as localhost, private networks or the cloud metadata address 169.254.169.254. Allow only http and https, resolve the address and refuse internal ranges, limit redirects, time and size, and return only the title and image.

Read the fix

Related terms

Production

The real, live version of your app that customers use, as opposed to the copy on your laptop.

Authentication

Checking who someone is, usually by signing in.

OAuth

The 'Sign in with Google' system. Google sends people back to your app only at addresses you registered.

Request

A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.

Response

The server's reply to a request: the data, plus a status code saying whether it worked.

Server

A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.