Free fixes / Card 3

Auth callback URL mismatch

Symptom

Google/GitHub login works locally, then in production it bounces home, shows an error, or "redirect URI mismatch."

Plain English

Auth providers only allow exact callback URLs you registered. Localhost is allowed. Your production /auth/callback (or similar) is not, until you add it in Supabase/Auth0/Clerk and in the Google/GitHub app settings.

Checklist

1. Note your live callback path (often /auth/callback or /api/auth/callback/google).
2. In the auth provider dashboard, add https://YOUR_DOMAIN + that exact path to allowed redirect URLs.
3. Add the same URL in the OAuth app (Google Cloud / GitHub OAuth app).
4. Set production env for client id/secret and site URL (not the localhost values).
5. Try login once in an incognito window on the live site.

Paste-ready fix prompt

Paste this into Cursor, Claude, Copilot, Lovable, Bolt, or whichever coding agent you use.

Production OAuth / magic-link auth fails after a local success. Assume redirect URL mismatch first.

1. Find every auth callback / redirect path this app uses.
2. Give me the exact production URLs I must whitelist in Supabase (or Clerk/Auth0) and in the Google/GitHub OAuth app.
3. List env vars that must differ between local and production for auth to work.
4. Add clearer error logging around the callback route without changing the product UI.
5. Keep the existing auth library; do not swap providers.