Why do my password reset emails link to localhost?
Because Supabase Auth builds the link from your project’s Site URL and the redirect URL your code sends, and one of them still points to localhost or a preview domain. Fixing it takes a settings change and usually a small code change.
A new Supabase project’s Site URL is http://localhost:3000. Supabase’s docs say to change it to your production URL, because email confirmations and password resets depend on it.
The fix
- In Supabase, open Authentication, then URL Configuration, and set the Site URL to your live domain.
- Add every domain you use, including previews if you need them, to the allowed Redirect URLs.
- In your code, pass redirectTo with the current domain when you call resetPasswordForEmail or sign in with a magic link, instead of a hard-coded URL.
- Check the email templates do not have a hard-coded domain.
- Make sure the page the link opens actually handles the reset and lets the user set a new password.
Test it the way users will
Request a reset on the live site, open the email on another device, follow the link and change the password. Then log in with the new one. Many apps pass the first two steps and fail the last.