How to Set Up Supabase Auth in Lovable
Add email/password and social login to your Lovable app using Supabase Auth. No backend code needed — just the right prompts.
Before you start
- ✓A Lovable account with an existing app
- ✓A Supabase project connected to your Lovable app
Step by step
Enable Supabase in Lovable
If you haven't already, click the Supabase icon in Lovable's sidebar and connect your project.
Paste this into Lovable:
Connect my app to Supabase for authentication.
Create the auth pages
Tell Lovable to generate a sign-up page, login page, and the auth logic that connects to Supabase.
Paste this into Lovable:
Create a complete authentication system with: 1. A /login page with email and password fields 2. A /signup page with email, password, and confirm password 3. A /forgot-password page 4. Use Supabase Auth for all auth operations 5. Redirect to /dashboard after successful login 6. Show error messages for invalid credentials 7. Add a 'Sign in with Google' button
Enable Google OAuth in Supabase
Go to Supabase → Authentication → Providers → Google. Enable it and paste your Google OAuth client ID and secret from the Google Cloud Console.
# In Supabase Dashboard: # Authentication → Providers → Google → Enable # Add your Google Client ID and Secret
Protect routes with auth guards
Make sure logged-out users can't access protected pages like the dashboard.
Paste this into Lovable:
Add an auth guard that: 1. Checks if the user is logged in on every protected page 2. Redirects to /login if not authenticated 3. Shows a loading spinner while checking auth state 4. Wrap /dashboard and all sub-pages with this guard
Add a user menu to the navbar
Show the user's email and a sign-out button in the navigation bar when logged in.
Paste this into Lovable:
Add a user dropdown menu to the top-right of the navbar that shows: 1. The user's email address 2. A link to /settings 3. A 'Sign out' button that calls Supabase signOut and redirects to /login 4. Only show this when the user is logged in
Common errors
The login page redirects to itself because the auth guard runs on the login page too.
Fix: Exclude /login, /signup, and /forgot-password from the auth guard.
Google sign-in popup closes immediately
Your redirect URL isn't configured in Supabase or Google Cloud Console.
Fix: Add your Lovable app URL to Supabase → Authentication → URL Configuration → Redirect URLs.
User not persisted after refresh
The auth state isn't being restored from the session.
Fix: Make sure Supabase's onAuthStateChange listener runs on app initialization.
Related guides
Weekly Newsletter
Get next week's fix before you need it.
Join developers getting weekly vibe coding tips, error fixes, and tool updates.
Subscribe on Substack →