What is OAuth?

The 'Sign in with Google' system. Google sends people back to your app only at addresses you registered.

Where OAuth goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

Launch day · 4 minutes · Pro
Sign in with Google: Error 400
'Sign in with Google' works perfectly on your laptop. On your real domain, users see 'Error 400: redirect_uri_mismatch'.
How do I fix Google redirect_uri_mismatch?
Add the exact callback URL your app uses in production to the allowed redirect URIs in Google Cloud Console and in your auth provider. It must match exactly, including https, domain, path and trailing slash. Google does not allow wildcards, so give each environment that needs sign-in a stable address.
Read the fix
Into the app stores · 3 minutes · Pro
The sign-in link opened the website
On a phone, people tap the sign-in link in their email. Instead of opening your app, Safari opens your website's home page, signed out.
Why does my magic link open the website?
Supabase only redirects to addresses in its Redirect URLs list. If your app's callback, such as yourapp://auth/callback, isn't listed, Supabase silently sends people to the Site URL, which is usually your website. Add the exact callback address to the list and make sure the scheme matches your app config.
Read the fix
The life of a click · 4 minutes · Pro
Confirm email, reach localhost
Your first real user signs up and clicks the confirmation link. Their browser says 'This site can't be reached: localhost'.
Why does my email link go to localhost?
Your auth provider's Site URL or redirect setting still points at your development address, so production users are sent to localhost, which only exists on your computer. Set the Site URL to your real domain and add each environment's exact callback URL to the allowed redirect list.
Read the fix

Authentication: Checking who someone is, usually by signing in.
Supabase: A popular hosted database with sign-in and file storage built in. Many AI app builders use it behind the scenes.
Production: The real, live version of your app that customers use, as opposed to the copy on your laptop.
localhost: An address that always means 'this computer'. It works on your laptop and nowhere else.
Browser: Chrome, Safari and friends. Everything that runs here is visible to, and changeable by, the person using it.
Environment variable: A setting stored outside your code, like a secret key. Your laptop and your live site each have their own copy.

All 62 terms in the glossary

Where OAuth goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

Launch day · 4 minutes · Pro

Sign in with Google: Error 400

'Sign in with Google' works perfectly on your laptop. On your real domain, users see 'Error 400: redirect_uri_mismatch'.

How do I fix Google redirect_uri_mismatch?

Add the exact callback URL your app uses in production to the allowed redirect URIs in Google Cloud Console and in your auth provider. It must match exactly, including https, domain, path and trailing slash. Google does not allow wildcards, so give each environment that needs sign-in a stable address.

Read the fix

Into the app stores · 3 minutes · Pro

The sign-in link opened the website

On a phone, people tap the sign-in link in their email. Instead of opening your app, Safari opens your website's home page, signed out.

Why does my magic link open the website?

Supabase only redirects to addresses in its Redirect URLs list. If your app's callback, such as yourapp://auth/callback, isn't listed, Supabase silently sends people to the Site URL, which is usually your website. Add the exact callback address to the list and make sure the scheme matches your app config.

Read the fix

The life of a click · 4 minutes · Pro

Confirm email, reach localhost

Your first real user signs up and clicks the confirmation link. Their browser says 'This site can't be reached: localhost'.

Why does my email link go to localhost?

Your auth provider's Site URL or redirect setting still points at your development address, so production users are sent to localhost, which only exists on your computer. Set the Site URL to your real domain and add each environment's exact callback URL to the allowed redirect list.

Read the fix

Related terms

Authentication

Checking who someone is, usually by signing in.

Supabase

A popular hosted database with sign-in and file storage built in. Many AI app builders use it behind the scenes.

Production

The real, live version of your app that customers use, as opposed to the copy on your laptop.

localhost

An address that always means 'this computer'. It works on your laptop and nowhere else.

Browser

Chrome, Safari and friends. Everything that runs here is visible to, and changeable by, the person using it.

Environment variable

A setting stored outside your code, like a secret key. Your laptop and your live site each have their own copy.