Supabase OAuth redirect URLs: Site URL plus allowlist, or the callback silently fails

TL;DR

Set Site URL to your production URL. TL;DR: Set Site URL to your production URL. # Supabase OAuth redirect URLs: the allowlist agents forget The most common OAuth failure in production: it works on YOUR_HOST and breaks on the real domain. Add every URL your app passes as redirectTo to the Redirect URLs allowlist: production, staging, preview deployments, and local dev.

TL;DR: Set Site URL to your production URL. # Supabase OAuth redirect URLs: the allowlist agents forget The most common OAuth failure in production: it works on YOUR_HOST and breaks on the real domain. Supabase only redirects to URLs on the allowlist.

Supabase OAuth redirect URLs: Site URL plus allowlist, or the callback silently fails

Supabase OAuth redirect URLs: the allowlist agents forget

The most common OAuth failure in production: it works on YOUR_HOST and breaks on the real domain. Supabase only redirects to URLs on the allowlist. An unlisted redirectTo does not produce a helpful error, the flow just fails or lands somewhere unexpected.

Checkable procedure

1. In the dashboard go to Authentication, URL Configuration. Set Site URL to your production URL. This is the default redirect target.
2. Add every URL your app passes as redirectTo to the Redirect URLs allowlist: production, staging, preview deployments, and local dev. Wildcards are limited, so list them explicitly.
3. In your sign-in call, pass redirectTo explicitly rather than relying on Site URL. When the app runs in multiple environments, the explicit value is what keeps each environment returning to itself.
4. Keep the default PKCE flow. The authorization code is exchanged server-side instead of landing in the URL, which is what makes step 3 safe to do from the client.
5. After any URL change, test the full flow in an incognito window. Cached sessions mask redirect misconfigurations.

The production checklist

Before launch, confirm the allowlist contains the production domain, the OAuth provider console (Google, GitHub) also lists your Supabase callback URL, and a fresh user can complete sign-in end to end. Miss any one of the three and some users cannot sign in at all.

Quick test

Sign in with OAuth from the production URL in incognito. If you land back in the app with a session, the allowlist is right. If the browser parks on an error page, diff the actual redirect URL against the allowlist character by character.

When to use

You hit exactly this: Supabase OAuth redirect URLs: Site URL plus allowlist, or the callback silently fails in Supabase OAuth redirect URLs.

When not to use

A different error, or the same symptom in a different tool. This page only covers the failure above.

Compatibility

Supabase OAuth redirect URLs.

Verified against live Supabase docs 2026-09-26: https://supabase.com/docs/guides/auth/social-login