The deploy-day OAuth checklist I use for Lovable, v0, and Bolt

Today’s thing I keep seeing in Lovable, v0, and Bolt projects: auth works on localhost, breaks right after deploy, and everyone starts rotating secrets first.

When I debug these, I dont start with the provider dashboard. I check 4 things in order: the public app URL, the auth library base URL, the exact redirect_uri the app is emitting, and the provider allow-list entry. Most failures are one of these: preview domain still registered, localhost baked into env at build time, callback path drifting between /api/auth/callback/* and a custom route, or http/https getting flipped by a proxy.

I built OAuth Redirect Doctor for exactly this boring diff step if you want a fast sanity check: https://oauth-redirect-doctor.vercel.app?utm_source=ih&utm_medium=post&utm_campaign=ih-roundup-2026-06-03