Bolt.new Auth Not Working After Deploy?

Auth problems in a Bolt.new app can be confusing because they often appear only after deployment. Login may work in preview, then fail on the live domain. Users may get stuck in a loop, land on the wrong page, lose their session or see protected content fail to load.

Check callback and redirect URLs

Supabase and OAuth providers need to know which URLs are allowed. Preview URLs, production domains and callback routes may all need configuration. If the live domain is missing, login can fail even when the code is mostly correct.

For full project repair, use the Bolt.new app repair page.

Check production environment variables

Auth often depends on Supabase URL, anon key, site URL and sometimes provider secrets. These values may exist in Bolt.new preview but not in Netlify or production hosting. Missing variables can create vague login failures or blank screens.

Check cookies, sessions and route guards

A user might authenticate successfully but still be redirected away because the app does not persist the session, reads auth state too early or has a route guard that expects profile data before it exists. Test signup, login, logout and refresh behaviour.

Check user profile creation

Some generated apps create a profile row after signup. If that insert fails because of RLS, a missing trigger or a wrong table name, the user can log in but the app still acts broken. Check Supabase auth users and the related profile table.

Check live-only domain behaviour

Auth can depend on exact domains. A deployment URL, custom domain and www/non-www version may behave differently. Make sure your allowed redirect settings match the real URL users will use.

When to ask for help

Auth affects user access and sometimes customer data. If every prompt rewrites the login flow, pause and get root cause diagnosis. If code changes are needed, generated code repair can stabilise the flow without replacing everything.

Checklist

• Check Supabase Site URL and redirect URLs.
• Check OAuth provider callback URLs.
• Check production environment variables.
• Test signup, login, logout and refresh.
• Check route guards and protected pages.
• Check profile table creation and RLS policies.

Conclusion

Bolt.new auth problems are usually a mix of code and configuration. The safest repair path is to trace the login journey from browser to Supabase to route guard before asking for another broad rewrite.

Test the complete auth journey

Auth is not just the login form. Test signup, email confirmation, login, logout, password reset, protected routes, refresh behaviour and what happens when a user returns later. A flow can appear fixed if you only test an already logged-in account.

Use a new user as well as an existing user. Some Bolt.new apps create profile records, roles or workspace records after signup. If that secondary step fails, login may technically succeed while the app still redirects, loops or blocks the user.

Why broad auth rewrites are risky

Auth touches access, data and trust. A broad rewrite can break existing users, change route protection or weaken permissions. Repair should start by finding the exact failing handoff between browser, Supabase, route guard and production domain.