This is the most common way a Lovable app stalls. The good news: it's usually five or six settings, not a rewrite. Here's what to check, in the order it tends to break.
In Supabase, open Authentication, then URL Configuration. The Site URL should be your live domain, and your domain (with and without www) should be in the redirect URL list. Then sign up again in a private window with an email you've never used.
You're logged in from development, so you never see the broken path. Test as a brand-new user. If email confirmation is on, make sure the confirmation email actually arrives (check spam) and that the link logs the user in, not just shows a blank page.
Each prompt changes code, but the bug is often in a dashboard setting the AI can't see. Stop prompting, open the browser console and the Supabase logs, and read the first error. If it says "redirect", "CORS", "JWT" or "permission denied", it's configuration.
Checkout works in test mode because the test webhook is set up. In live mode you need a separate live webhook endpoint with its own signing secret, stored as a secret in your edge function. Make a real $1 purchase and check that the user's row changes.
Log in as a second user and change an ID in the URL or in a network request. If you see the first user's records, row-level security is off or too loose on that table. Fix this before you invite anyone, since your anon key is public by design.
Open DevTools, then Sources, and search for sk_live, service_role and secret. Anything you find is public. Rotate the key first, then move the call into an edge function.
Supabase's built-in email is rate-limited and meant for testing. Use your own SMTP sender (Resend, Brevo, Postmark) and set up SPF and DKIM on your domain.
We'll run your live app as a real customer would (sign up, log in, pay, get the emails) and send you every failure with screenshots. That report is free. If you want us to fix what we find, it's a fixed $249 for sign-up, payments and email, or $499 for bigger jobs. You give us a GitHub collaborator invite; we never ask for your password. Bolt, Replit and Cursor apps too.