{
  "id": 16315761,
  "title": "Supabase confirmation or reset email opens localhost:3000? Here's the fix",
  "url": "https://urgent.news/2026/10/24/supabase-confirmation-or-reset-email-opens-localhost-3000-heres-the",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-24T11:07:25.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/ahmed_hassanyaseen_1b7ab/supabase-confirmation-or-reset-email-opens-localhost3000-heres-the-fix-5c82"
  },
  "original_language": "en",
  "account": "When a user signs up for a Supabase live application, clicks the confirmation link, or requests a password reset, they are directed to the localhost:3000 URL. This occurs because Supabase builds email links from the project's Site URL, which defaults to localhost:3000 for new projects. This issue affects apps built with various frameworks like Lovable, Bolt, and Replit on Supabase, particularly after the first real users arrive.\n\nThe Site URL is set to localhost:3000 by default. Every confirmation and reset link falls back to this URL, causing them to all point to localhost:3000. The redirect address isn't allowed in Supabase. If your app redirects to a location not on the Redirect URLs list, Supabase uses the Site URL instead. A customised email template uses {{ .SiteURL }}, which ignores the redirect passed by the app. To resolve this issue, you can either set the Site URL to your live domain, add every redirect address under Redirect URLs, and pass a redirect address that is on that list, or pass the redirect address from the app using window.location.origin.\n\nAfter making these changes, check by signing up with a new email address. The confirmation link should open your live site and sign the user in. Similarly, requesting a password reset should open the reset page on the live domain. This fix does not require redeployment, as it's a project setting that new emails use immediately. However, emails already sent keep their old links, so affected users should request a new confirmation or reset email.",
  "summary": "A user signs up for your live app, clicks the confirmation link, and the browser says: localhost:3000 refused to connect Password reset emails do the same. Nothing is wrong with your deploy. Supabase builds email links from the project's Site URL , and a new project starts with that set to http://localhost:3000 . Set the Site URL to your live domain, add every address you redirect to under…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}