What is Production?

The real, live version of your app that customers use, as opposed to the copy on your laptop.

Where Production goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

Data you can lose · 5 minutes · Free
The agent that reset production
You asked your coding agent to fix a failing migration. It says it 'reset the database to resolve drift'. Your live customers are gone.
How do I stop an AI agent deleting my database?
Do not keep production database credentials where the agent runs. Use a separate development database locally, give production a role that cannot drop tables, and keep backups the agent cannot reach. Instructions like 'never touch production' are not enough; only permissions reliably stop a destructive command.
Walk it, free
The life of a click · 4 minutes · Pro
Works on my machine
Sign-up works perfectly on your laptop. On the live site, every sign-up fails.
Why does it work locally but not in production?
The most common cause is a missing environment variable. Your .env file exists only on your laptop; production has its own settings. Add the variable in your hosting dashboard, redeploy, and validate required variables at startup so a missing one fails the deploy instead of your users.
Read the fix
The life of a click · 4 minutes · Pro
Confirm email, reach localhost
Your first real user signs up and clicks the confirmation link. Their browser says 'This site can't be reached: localhost'.
Why does my email link go to localhost?
Your auth provider's Site URL or redirect setting still points at your development address, so production users are sent to localhost, which only exists on your computer. Set the Site URL to your real domain and add each environment's exact callback URL to the allowed redirect list.
Read the fix
Launch day · 4 minutes · Pro
The 504 at second 60
Generating a long AI report works on your laptop. In production, where the route's time limit is set to 60 seconds, big reports fail with '504 Gateway Timeout'.
Why do I get a 504 timeout only in production?
Hosted serverless functions stop at a set time limit, while your laptop has none. Long AI calls, imports or file processing exceed it and return 504 Gateway Timeout. Streaming improves the wait but still counts toward the limit; move long tasks to a background job that reports progress.
Read the fix
Launch day · 4 minutes · Pro
Sign in with Google: Error 400
'Sign in with Google' works perfectly on your laptop. On your real domain, users see 'Error 400: redirect_uri_mismatch'.
How do I fix Google redirect_uri_mismatch?
Add the exact callback URL your app uses in production to the allowed redirect URIs in Google Cloud Console and in your auth provider. It must match exactly, including https, domain, path and trailing slash. Google does not allow wildcards, so give each environment that needs sign-in a stable address.
Read the fix
Data you can lose · 3 minutes · Pro
Project paused
A quiet week, then a client demo. Your app shows errors. Your database dashboard says 'Project paused'.
Why was my Supabase project paused?
Free projects are paused after a period of inactivity to save resources. A paused project rejects requests until restored. For an app real people use, move to a paid plan, which is not paused, and keep your own regular export of the data regardless of the plan.
Read the fix

Request: A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.
Server: A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.
API: The part of an app that other programs talk to. Your app's pages ask its API for data, like a waiter taking orders to a kitchen.
Endpoint: One specific address on your server that does one job, like /api/invoices. Each one needs its own safety checks.
Browser: Chrome, Safari and friends. Everything that runs here is visible to, and changeable by, the person using it.
Secret key: A password your app uses to talk to a paid service. Anyone who sees it can use it, and spend your money.

All 62 terms in the glossary

Where Production goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

Data you can lose · 5 minutes · Free

The agent that reset production

You asked your coding agent to fix a failing migration. It says it 'reset the database to resolve drift'. Your live customers are gone.

How do I stop an AI agent deleting my database?

Do not keep production database credentials where the agent runs. Use a separate development database locally, give production a role that cannot drop tables, and keep backups the agent cannot reach. Instructions like 'never touch production' are not enough; only permissions reliably stop a destructive command.

Walk it, free

The life of a click · 4 minutes · Pro

Works on my machine

Sign-up works perfectly on your laptop. On the live site, every sign-up fails.

Why does it work locally but not in production?

The most common cause is a missing environment variable. Your .env file exists only on your laptop; production has its own settings. Add the variable in your hosting dashboard, redeploy, and validate required variables at startup so a missing one fails the deploy instead of your users.

Read the fix

The life of a click · 4 minutes · Pro

Confirm email, reach localhost

Your first real user signs up and clicks the confirmation link. Their browser says 'This site can't be reached: localhost'.

Why does my email link go to localhost?

Your auth provider's Site URL or redirect setting still points at your development address, so production users are sent to localhost, which only exists on your computer. Set the Site URL to your real domain and add each environment's exact callback URL to the allowed redirect list.

Read the fix

Launch day · 4 minutes · Pro

The 504 at second 60

Generating a long AI report works on your laptop. In production, where the route's time limit is set to 60 seconds, big reports fail with '504 Gateway Timeout'.

Why do I get a 504 timeout only in production?

Hosted serverless functions stop at a set time limit, while your laptop has none. Long AI calls, imports or file processing exceed it and return 504 Gateway Timeout. Streaming improves the wait but still counts toward the limit; move long tasks to a background job that reports progress.

Read the fix

Launch day · 4 minutes · Pro

Sign in with Google: Error 400

'Sign in with Google' works perfectly on your laptop. On your real domain, users see 'Error 400: redirect_uri_mismatch'.

How do I fix Google redirect_uri_mismatch?

Add the exact callback URL your app uses in production to the allowed redirect URIs in Google Cloud Console and in your auth provider. It must match exactly, including https, domain, path and trailing slash. Google does not allow wildcards, so give each environment that needs sign-in a stable address.

Read the fix

Data you can lose · 3 minutes · Pro

Project paused

A quiet week, then a client demo. Your app shows errors. Your database dashboard says 'Project paused'.

Why was my Supabase project paused?

Free projects are paused after a period of inactivity to save resources. A paused project rejects requests until restored. For an app real people use, move to a paid plan, which is not paused, and keep your own regular export of the data regardless of the plan.

Read the fix

Related terms

Request

A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.

Server

A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.

API

The part of an app that other programs talk to. Your app's pages ask its API for data, like a waiter taking orders to a kitchen.

Endpoint

One specific address on your server that does one job, like /api/invoices. Each one needs its own safety checks.

Browser

Chrome, Safari and friends. Everything that runs here is visible to, and changeable by, the person using it.

Secret key

A password your app uses to talk to a paid service. Anyone who sees it can use it, and spend your money.