Magic link works locally, on production it says 'invalid or expired'

Solved · 2401 views · asked 2 weeks ago by sam_builds · edited

Email login works on localhost. On the deployed site I get the email, click the link, and land on /login?error=Email link is invalid or has expired. The link is fresh.

What I’ve tried

Set the Site URL in Supabase to my domain
Redeployed twice

Comment

Is the link opening in the same browser you requested it from? Some mail apps open links in their own in-app browser. jonas_k 2 weeks ago · edited

1 answer

Marked as helpful by the asker

mira_dev2 weeks ago · edited

Add your production URL to Authentication → URL Configuration → Redirect URLs (with /** at the end). Site URL alone is not enough, Supabase only redirects to URLs on that allow-list, otherwise it falls back and the token is consumed on the wrong page.

Second thing to check: some mail clients pre-fetch links to scan them. That consumes the one-time token before you click. Use a PKCE flow (token_hash in the URL) instead of the implicit one; @supabase/ssr does this by default.

Comment

Redirect URLs was missing the /**. Works now. Also switched to the PKCE flow after reading the second part. sam_builds 2 weeks ago · edited

Same for me on Lovable, Outlook safe links were "clicking" my magic links before I did. The token_hash flow fixed it. bakery_bo 2 weeks ago · edited

Yes, link scanners are the second most common cause after redirect URLs. mira_dev 2 weeks ago · edited

Keyboard shortcuts

Magic link works locally, on production it says 'invalid or expired'

What I’ve tried

1 answer

Your answer

Magic link works locally, on production it says 'invalid or expired'

What I’ve tried

1 answer

Related

Your answer