Error fixes / Supabase
Supabase
Supabase sign-in returns with error_description in the URL
Auth sent the browser back to your site with an error in the URL fragment.
The error
#error=...&error_code=4...&error_description=...
What it means
Supabase documents this pattern. When sign-in fails, the user is still redirected, and the error is in the URL fragment as error, error_code and error_description. Their guide says error codes that start with 4 should be shown to the user. The usual setup mistake is a redirectTo value that is not on the Redirect URLs allow list, or a Site URL that is still http://localhost:3000 after you deploy.
Fix
- Copy the error_description from the URL fragment. That sentence is the specific cause. Do not ignore it and only look at the blank page.
- In Supabase, open Authentication, URL Configuration. Set Site URL to the live https origin.
- Add the exact redirect URL the code passes as redirectTo. Wildcards are easy to get wrong: a single star does not cross a slash.
- In the code, build redirectTo from the production site URL, not a hard-coded localhost value that ships to users.
- If you changed email templates, Supabase notes that redirectTo only applies when the template uses the RedirectTo field instead of SiteURL alone.
Prompt
Fix prompt
After sign-in, the browser lands on a URL whose fragment contains error and error_description. Supabase documents this as a failed auth redirect. Find every redirectTo value. Build it from the production site URL environment variable, with http://localhost only in development. Tell me the exact Site URL and Redirect URLs to paste into Supabase URL Configuration. Parse the fragment and show error_description on the page instead of a blank screen. Do not widen the allow list to a single star on the whole internet.
Questions
Where do I read the real error?
In the page URL after the hash. Supabase's redirect guide shows reading error_code and error_description from that fragment. The description is the message you should show.
Local sign-in works. Production sign-in does not. Why?
Site URL is probably still localhost, or the production callback is missing from Redirect URLs. The allow list is per project, and preview URLs need their own entry.
Can I allow every URL so this stops?
No. The allow list is what stops a sign-in token being sent to another site. Add the origins you own, including a tight wildcard for previews if you need one.