Everything that made my magic links say 'invalid or expired' in production. Local always worked.
Workflow
Copied 6 times
1. Redirect URLs in Supabase Auth contain the production URL with /** at the end.
2. Site URL is the production URL, not localhost.
3. Use the PKCE flow (token_hash in the URL), so mail scanners cannot burn the link.
4. The callback route exchanges the code server-side and sets cookies.
5. Test from a phone with a different mail app than yours.
AskVibe