Supabase auth kept sending reset links to the wrong host, the diff I check first

I kept seeing the same Supabase auth bug this week: password reset emails, confirm links, or Google sign-in callbacks looked fine until the actual URL still carried localhost, an old preview domain, or the wrong callback path.

When I debug it, I dont start in the provider dashboard. I pull the literal link from the email or the exact redirect_uri leaving the app, then line up 4 things side by side: Supabase Site URL, allowed Redirect URLs, the callback path the app is actually emitting, and any explicit emailRedirectTo or reset redirect in code. Most of the time one stale value is doing all the damage.

Built a free preview for this exact diff if you want to sanity check a broken flow: https://oauth-redirect-doctor.vercel.app?utm_source=ih&utm_medium=post&utm_campaign=ih-roundup-2026-06-04