Lovable app sends you back to the login page? How to fix the Supabase login loop

What the loop looks like

The user signs in, the page flashes, and they land back on the login screen. Sometimes it only happens on the live domain, never in the Lovable preview. Sometimes it only happens after clicking the email confirmation link or after signing in with Google.

Those details tell you which cause you have, so note exactly when it happens before changing anything.

1. Supabase still points at your preview URL

Supabase only sends users back to addresses it trusts. If the Site URL in Authentication → URL Configuration is still the Lovable preview or localhost, confirmation emails and Google sign-in send users to the wrong place, where no session exists, and your app sends them to login again.

• Set Site URL to your real domain, for example https://www.yourapp.com.
• Add every address users can land on to Redirect URLs: the www and non-www versions, the preview URL if you still use it, and any callback path such as /auth/callback.
• Pick one canonical domain and redirect the other to it, because the session is stored per domain: a session saved on yourapp.com does not exist on www.yourapp.com.

2. The route guard redirects before the session loads

On the first render the Supabase client has not read the stored session yet, so the user looks signed out for a moment. A guard that redirects as soon as it sees no user will send a signed-in person to login, then the login page sees the session and sends them back, and the loop starts.

Track a loading state and only redirect once Supabase has reported the initial session.

const [session, setSession] = useState<Session | null>(null);
const [loading, setLoading] = useState(true);

useEffect(() => {
  const { data } = supabase.auth.onAuthStateChange((_event, s) => {
    setSession(s);
    setLoading(false); // fires once with INITIAL_SESSION on load
  });
  return () => data.subscription.unsubscribe();
}, []);

if (loading) return <Spinner />;          // do not redirect yet
if (!session) return <Navigate to="/login" replace />;

3. More than one Supabase client

AI tools often call createClient in several files. Each client can keep its own copy of the auth state, so one part of the app thinks the user is signed in and another does not. Create the client once, export it, and import that same instance everywhere.

4. You moved the app to Next.js and sessions stopped sticking

A Lovable app keeps the session in the browser. Next.js pages and middleware run on the server, which cannot read browser storage, so the server sees every user as signed out and redirects them.

Use the @supabase/ssr package so the session is stored in cookies, refresh it in middleware, and add a callback route that exchanges the sign-in code for a session when you use magic links or Google sign-in.

5. Email confirmation is on, but users never confirm

If Confirm email is enabled, a new user has no session until they click the link. The app may treat the sign-up as a sign-in and send them to a protected page, which sends them back to login. Show a "check your email" screen after sign-up instead of redirecting.

How to find your cause in 5 minutes

• Watch the address bar during sign-in: does it ever switch between www and non-www, or to the preview domain?
• Open DevTools → Application → Local Storage and look for a key like sb-<project>-auth-token after signing in.
• Check Authentication → Logs in Supabase: a successful sign-in there means the problem is in your app, not in Supabase.
• Search the code for createClient: more than one result is a warning sign.