Why is my Lovable app broken? The 5 most common failures (2026)

01# Browser console after production deploy02Uncaught Error: supabaseUrl is required.03    at new SupabaseClient (supabase-js.mjs:??)04    at createClient (supabase.ts:3)05    at <anonymous> (layout.tsx:12)06 07# Or on Vite builds:08[vite:define] Could not resolve import.meta.env.VITE_SUPABASE_URL09error during build:10Error: Missing required env var VITE_SUPABASE_URL

01# Required by every Lovable + Supabase app02NEXT_PUBLIC_SUPABASE_URL=https://<project-ref>.supabase.co03NEXT_PUBLIC_SUPABASE_ANON_KEY=eyJhbGciOi...04SUPABASE_SERVICE_ROLE_KEY=eyJhbGciOi...    # server-only, NEVER NEXT_PUBLIC_05 06# If the app uses Stripe07STRIPE_SECRET_KEY=sk_live_...               # live, not sk_test_08STRIPE_WEBHOOK_SECRET=whsec_...             # the live-mode endpoint's secret09 10# If OAuth is enabled11NEXT_PUBLIC_SITE_URL=https://yourapp.com    # must be your real domain

01-- The explicit deny02ERROR: new row violates row-level security policy for table "tasks"03  STATE: 4250104 05-- The silent deny (read side)06-- Client sees: HTTP 200 OK with []07-- Postgres log shows the query ran but no rows matched any SELECT policy08 09-- The worst one: RLS disabled entirely10WARNING: RLS is disabled on table "tasks"11  Rows are visible to every role including anon.

01-- Enable RLS02alter table public.tasks enable row level security;03 04-- SELECT: see your own rows05create policy "tasks_select_own" on public.tasks06  for select to authenticated07  using (auth.uid() = user_id);08 09-- INSERT: write rows owned by you10create policy "tasks_insert_own" on public.tasks11  for insert to authenticated12  with check (auth.uid() = user_id);13 14-- UPDATE: modify your own rows15create policy "tasks_update_own" on public.tasks16  for update to authenticated17  using (auth.uid() = user_id)18  with check (auth.uid() = user_id);19 20-- DELETE: remove your own rows21create policy "tasks_delete_own" on public.tasks22  for delete to authenticated23  using (auth.uid() = user_id);24 25-- Default the ownership column so clients cannot forget it26alter table public.tasks27  alter column user_id set default auth.uid();

01# Google's own error (most common)02https://accounts.google.com/signin/oauth/error/v2?03  authError=...&error=redirect_uri_mismatch04 05# Supabase rejects the callback06https://yourapp.com/?error=invalid_request07  &error_description=Redirect+URL+is+not+allowed08 09# Session disappears after redirect10# URL is correct but application cookies are empty:11# Missing: sb-access-token, sb-refresh-token12# Cause: Site URL still points at the preview domain

01// supabase/functions/_shared/cors.ts02export const corsHeaders = {03  "Access-Control-Allow-Origin": "https://yourapp.com",04  "Access-Control-Allow-Headers":05    "authorization, x-client-info, apikey, content-type",06  "Access-Control-Allow-Methods": "POST, GET, OPTIONS",07  // NEVER use "*" if you send credentials (cookies, Authorization)08};09 10// supabase/functions/my-fn/index.ts11import { corsHeaders } from "../_shared/cors.ts";12 13Deno.serve(async (req) => {14  if (req.method === "OPTIONS") {15    return new Response("ok", { headers: corsHeaders });16  }17 18  // ... your handler ...19  return new Response(JSON.stringify({ ok: true }), {20    headers: { ...corsHeaders, "Content-Type": "application/json" },21  });22});