--- title: "Verification link points to localhost:3000? Here's the fix · Proxy Mail QA" description: "Why sign-up, magic-link and reset emails link to localhost:3000 on staging or production, and how to fix it in Supabase, Firebase, Auth.js, Rails and Django." url: https://proxymail.qa/solve/localhost-links --- 1. [Home](https://proxymail.qa/) 2. [What we solve](https://proxymail.qa/solve) # Why your verification link goes to localhost:3000, and how to fix it You sign up on staging, the email arrives, you click the link and get "This site can't be reached" at localhost:3000\. The email isn't broken: your app is putting a development address into it. Updated 18 October 2026 ## What’s happening Every verification, magic-link, invite and reset email contains a link back to your app. Your auth provider or framework builds that link from a setting: the site URL, a redirect URL, or the host your mailer is configured with. When that setting still says `http://localhost:3000`, every email points at the developer’s own computer. Sometimes the link itself is hosted, for example `https://yourproject.supabase.co/auth/v1/verify?...`, and only the page it redirects to afterwards is local. The verification succeeds, then the browser is sent to `localhost:3000` and fails. That version is easy to miss, because the email looks fine. ## Fix it in Supabase (including Lovable apps on your own Supabase project) 1. In the Supabase dashboard, open **Authentication → URL Configuration**. 2. Set **Site URL** to your live address, such as `https://your-app.lovable.app` or your own domain. A new Supabase project starts with `http://localhost:3000` here. 3. Add every other environment you use (staging, preview domains, localhost for development) to **Redirect URLs**. Wildcards are supported for preview deployments. 4. If your code passes `emailRedirectTo` or `redirectTo` when calling sign-up or sign-in, build it from the current site, for example `window.location.origin`, or an environment variable. A redirect that isn’t on the allow list falls back to the Site URL. 5. If you’ve customised the email templates, check they use the template’s confirmation URL or site URL variables rather than a hard-coded address. ## Fix it in Firebase Authentication - Check the continue URL your code passes in its action code settings when sending verification or sign-in links. It should come from the environment, not a hard-coded `http://localhost`. - Add your live domain under **Authentication → Settings → Authorized domains**. ## Fix it in other stacks - **Auth.js / NextAuth:** set the deployment URL (`AUTH_URL`, or `NEXTAUTH_URL` on older versions) where your host doesn’t infer it. - **Ruby on Rails:** set `config.action_mailer.default_url_options` with the right `host` in each environment’s config. - **Django:** build links from the request or the Sites framework, and make sure the site’s domain isn’t still `example.com` or `localhost`. - **Laravel:** set `APP_URL` for each environment. - **Anything else:** search the code for `localhost:3000` and move it into an environment variable. ## On a phone simulator or emulator The iOS simulator shares your computer’s network, so `localhost` links open there. The Android emulator doesn’t: it reaches your computer at `10.0.2.2`, so a link to `localhost:3000` opens nothing. For an emulator, point the app’s links at `http://10.0.2.2:3000`, or better, at a staging address both can reach. More in [Mobile apps](https://proxymail.qa/docs/mobile). ## How Proxy Mail QA flags it When a link in a test email points at a local address, or redirects to one after verifying, Proxy Mail QA marks it on the Accounts row (“Redirects to localhost:3000”) and explains it in the inbox. You can tell at a glance that the environment is misconfigured, before anyone files it as “verification is broken”. If you’re testing a local build on purpose, choose **This is my dev environment**. Links to that host stop being flagged in that project, and the email checks pass them. You can remove it again from the project’s settings. A coding agent can mark the host itself with the MCP tool `mark_dev_host`, and a test suite with `POST /v1/project/dev-hosts` (`markDevHost` in the [Node.js client](https://proxymail.qa/docs/node), `mark_dev_host` in the [Python helper](https://proxymail.qa/docs/python)). ## Try it on your next sign-up test Free plan, no credit card. Create an address and watch the code or link arrive. [Create a free account](https://app.proxymail.qa/?mode=signup&from=site-solve-localhost-links) ## Questions ### Why does the link work for the developer but not for me? localhost always means "this computer". On the developer's laptop their dev server is running, so the link opens. On anyone else's machine there is nothing listening, so it fails. ### Is a localhost link ever correct? Yes, when you're testing a local build on purpose and the dev server runs on the same computer you click from. In Proxy Mail QA, mark that host as a dev environment and links to it won't be flagged again in that project. ### I fixed the setting. Why do old emails still link to localhost? The address is written into each email when it's sent. Request a new email after changing the setting; the old ones will keep their old links. ### Which links does Proxy Mail QA flag? Links to localhost, 127.0.0.1, 0.0.0.0, private network addresses such as 192.168.x.x, and names ending in .local, .test or .localhost, plus hosted links that redirect to one of those after verifying, such as Supabase's redirect\_to or Firebase's continueUrl. ## Related guides - [Test sign-up and email verificationA fresh, private address for every sign-up test, with the verification link or code ready the moment it lands.](https://proxymail.qa/solve/email-verification-testing) - [Test OTP and one-time login codesCodes pulled out of the email with a Copy button and a countdown when the email says how long they last.](https://proxymail.qa/solve/otp-code-testing) - [Test magic links and passwordless sign-inSingle-use links that are never opened or prefetched on our side, so they still work when you click them.](https://proxymail.qa/solve/magic-link-testing) - [Test password reset emailsRequest, receive and use reset links, and keep the new password saved next to the test account.](https://proxymail.qa/solve/password-reset-testing) - [Stop sharing one Gmail inbox for QAPrivate, disposable addresses for every tester instead of one shared mailbox and a pile of plus-addresses.](https://proxymail.qa/solve/shared-test-inbox) - [Take QA notes by voice with Wispr FlowDictate what each test account is for, its state and what you found, straight into its notes, in seconds.](https://proxymail.qa/solve/voice-notes-wispr-flow) - [Common Supabase sign-up and login problemsEmails that never arrive, links that expire or sign nobody in, and sign-ups that fail, with the fix for each.](https://proxymail.qa/solve/supabase-auth-problems) - [Common Firebase sign-up and login problemsMissing verification and reset emails, verified users who still look unverified, failing links and sign-up limits, with the fix for each.](https://proxymail.qa/solve/firebase-auth-problems) - [Sign-up and login problems in vibe-coded appsThe login bugs AI-built apps usually ship with: emails only you receive, links to the preview, missing pages, and what to ask the builder.](https://proxymail.qa/solve/vibe-coded-login-problems) - [Test sign-up emails in PlaywrightA complete Playwright test for sign-up codes and links, from a fresh inbox to the report on the pull request.](https://proxymail.qa/solve/playwright-email-tests) - [Test sign-up emails in CypressA complete Cypress test for sign-up links and codes, with the email waits running as Cypress tasks.](https://proxymail.qa/solve/cypress-email-tests) - [Test sign-up emails with pytestA complete pytest test for sign-up codes and links, with Playwright for Python or Selenium and a one-file helper.](https://proxymail.qa/solve/pytest-email-tests) - [Test coupon codes and welcome offersThe coupon with its discount, end date and arrival time, what checkout did with it, and a failure when an expired or reused one is accepted.](https://proxymail.qa/solve/coupon-code-testing) - [Test unsubscribe links and one-click unsubscribeThe unsubscribe headers and link checked on every marketing email, and a watch that flags any marketing after unsubscribing, with no time limit.](https://proxymail.qa/solve/unsubscribe-testing) - [Test that a welcome offer can't be claimed twiceVersions of one address that reach the same inbox, and a check that fails when the same person got the offer more than once.](https://proxymail.qa/solve/welcome-offer-abuse) [Built your app with an AI tool? Pick yours](https://proxymail.qa/built-with)