Guides
Fixes for the things that break after you ship
23 practical guides for the failures people search for after building an app with an AI tool. Each one starts with a short answer and ends with a prompt you can paste into your builder.
Auth redirects & email links
Lovable login works in preview but not after publish?
Sign-in works in the Lovable preview but fails on your published app or custom domain? Fix the Site URL, redirect URLs and Google settings.
Supabase magic link redirects to localhost? Fix it
Supabase magic links or confirmation emails sending users to localhost:3000 in production? Set the Site URL, allowlist redirects and pass emailRedirectTo.
Google login redirects to localhost after deploy?
Google sign-in sends users to localhost or fails after deploying your Supabase, Lovable or Bolt app? Check these four settings together.
Supabase "Email link is invalid or has expired" fix
Users see otp_expired or "Email link is invalid or has expired" right after clicking? Email scanners pre-click the link. Here's the fix.
Signup failures
Supabase "Database error saving new user": the fix
Signup fails with "Database error saving new user"? It's almost always a trigger on auth.users. Find the real error in the logs and fix it safely.
"new row violates row-level security" on signup?
Signup fails with "new row violates row-level security policy for table profiles"? Don't disable RLS. Create the profile in a trigger instead.
Supabase confirmation email not sending? Fix it
Supabase signup emails not arriving, "Email address not authorized" or "email rate limit exceeded"? Set up custom SMTP and raise the limit.
Bolt signup flow broken
Why a Bolt app can lose its signup form after a prompt, and how to ask for the form back without a rewrite.
Silent regressions
AI edit silently broke your login? How to fix it
Lovable, Bolt or Cursor changed something and now login is broken? Roll back, find the exact change, and stop it from happening again.
Uptime is green but checkout is broken
Why a status page stays green while signup or checkout is dead, and what to monitor instead.
Stripe checkout & webhooks
Stripe "No signatures found matching" webhook fix
Stripe webhook failing with "No signatures found matching the expected signature for payload"? Use the raw body and the right whsec_ secret.
Stripe webhook failing with a 307 or 308 redirect?
Stripe webhook deliveries failing with 307, 308 or 301? Stripe treats redirects as failures. Point the endpoint at the exact final URL.
Stripe checkout works in test mode but not live?
Stripe checkout fine in test mode but broken after going live? Live keys, live price IDs, a separate live webhook and a rebuild. Full checklist.
User paid but subscription not updated in Supabase?
Customer paid in Stripe but your Supabase app still shows the free plan? Fix the webhook events, user mapping and the silent RLS write.
Lovable Stripe payments not working? Fix checklist
Lovable checkout not opening, failing live, or not unlocking features? First check which Stripe setup you use, then work through this list.
Deploys & env vars
"supabaseUrl is required" in production? Fix it
App works locally but production shows a blank page and "supabaseUrl is required" or "supabaseKey is required"? Add the env vars and rebuild.
Bolt.new app blank white page on Netlify? Fix it
Bolt app works in preview but shows a blank page on Netlify? Publish dist (not source), add VITE_ env vars, add the SPA redirect and rebuild.
Supabase "TypeError: Failed to fetch" on login?
Login or signup on your live site fails with "TypeError: Failed to fetch"? Use the Network tab to find which of 5 causes it is, then fix it.
Supabase project paused and your app is down?
Supabase paused your free project and login stopped working? How to restore it, what's kept, and how to stop it happening again.
Edge Functions & CORS
Security: keys & RLS
Is your Supabase anon key safe in the browser?
Is it OK that your Supabase anon or publishable key is visible in your app? Yes, but only if RLS is on for every table with the right policies.
Supabase service_role key exposed? What to do now
Your Supabase service_role or secret key is in your front-end code? It bypasses all RLS. Here's how to remove it, rotate it and check for damage.
Missing security headers
Which response headers matter on an AI-built app, which ones are noise, and a small snippet to add them.