--- title: "Sign-up and login problems in vibe-coded apps, and fixes · Proxy Mail QA" description: "The sign-up, login and password-reset bugs apps built with Lovable, Bolt, v0, Replit, Cursor or Claude Code usually ship with, and how to find and fix each." url: https://proxymail.qa/solve/vibe-coded-login-problems --- 1. [Home](https://proxymail.qa/) 2. [What we solve](https://proxymail.qa/solve) # Sign-up and login problems in vibe-coded apps, and how to fix them An AI builder can add accounts to your app in one prompt, and it works when you try it. The trouble starts when someone else signs up: you’re on the email service’s team, already signed in and on the right domain, and they aren’t. These are the problems that show up then, and what to ask your builder to change. Updated 23 October 2026 Most AI-built apps sign people in with Supabase (Lovable, Bolt, v0 and many apps from Cursor or Claude Code), Firebase (Antigravity), Clerk, or the builder’s own login (Replit, Base44). The provider pages cover each in depth: [Supabase problems](https://proxymail.qa/solve/supabase-auth-problems), [Firebase problems](https://proxymail.qa/solve/firebase-auth-problems). This page covers what generated apps add on top. ## It works for you, and no one else You built the app, so you’re on the Supabase project’s team, you’re probably still signed in, and you test on the domain the builder showed you. A tester has none of those: - **The email service only emails you.** Supabase’s built-in sender delivers only to the project’s team, at most 2 emails an hour. Set up custom SMTP. On Lovable Cloud, check the sending limits in Auth settings. - **You’re already signed in.** A broken sign-up still looks fine to someone with a session. Test in a private window, with an address that has never been used. ## The link opens the preview, or localhost The email’s link is built from the app’s public address setting. If it was left at `http://localhost:3000`, or set to a preview link that changed on the next deploy, people land on a page that doesn’t open. On Lovable Cloud, Lovable sets it when you publish unless you’ve set one yourself; on your own Supabase project, it’s the Site URL. Set it to the published domain and list previews under Redirect URLs. More in [why emails link to localhost](https://proxymail.qa/solve/localhost-links). Proxy Mail QA flags these links on the address’s row. ## Clicking the link signs nobody in The link brings a code back to your app, and a page has to swap it for a session. Generated apps often send the link to the home page, which ignores the code, so the person arrives signed out and assumes it failed. Ask for a page that finishes sign-in (often `/auth/callback`) and points the email’s link at it. With Supabase, testers should open the link in the browser they signed up in: [why](https://proxymail.qa/solve/supabase-auth-problems#the-link-opens-but-nobody-is-signed-in). ## “Check your email”, whatever happened Generated sign-up forms often show the same success message whatever the provider answered. Behind it: - **The address already has an account.** Supabase answers as if sign-up worked and sends nothing, so it doesn’t reveal who has an account. The app should say: “If that address is new, we’ve sent a link. Already signed up? Sign in or reset your password.” - **It was too soon.** A second request within 60 seconds is refused, and the app hides the error. - **Email confirmation is off.** The account was created and signed in, with no email at all. Ask the builder to show the provider’s error when there is one, and to word the success message so it’s true either way. ## The reset email has nowhere to go A password reset link signs the person in, then the app has to show a “choose a new password” form. Generated apps often skip that page, so the person is signed in with their old password and no way to change it. Ask for a reset page that the link opens, and test it end to end: [Test password reset emails](https://proxymail.qa/solve/password-reset-testing). ## Forms that turn away real people, or let bad data through - **Too strict:** some generated forms reject addresses with a `+`, capitals or a newer domain ending such as `.dev`, or names with an apostrophe. [Unusual addresses](https://proxymail.qa/docs/unusual-addresses) and [unusual names and passwords](https://proxymail.qa/docs/unusual-names-and-passwords) list what to try. - **Too loose:** the form accepts a value the database won’t, and sign-up fails with “Database error saving new user” when the app’s `profiles` table rejects it. A 255-character name or an empty username finds these. ## Confirmation was switched off while building Builders sometimes turn off email confirmation so sign-up is quicker to try, and it stays off at launch. Then anyone can sign up with an address they don’t own, and you never see whether the confirmation email works. Switch it back on before you share the app, and test it with an address that receives mail. ## The agent says it’s done A coding agent checks that the form submits, not that the email arrives or its link works. Connect the [Proxy Mail QA MCP server](https://proxymail.qa/docs/mcp) and ask it to sign up with a new address, wait for the code or link and finish the sign-up. It reads only the code or link, never the email’s text. ## Copy-paste prompts for your builder Prompt ```text Check our login setup: list every email the app sends (sign-up confirmation, magic link, password reset, email change), which service sends it, and the page each link opens. Flag any link built from localhost or a preview address, and any link that opens a page that doesn't finish signing in. ``` Prompt ```text Add a page that finishes sign-in when someone opens the link in a confirmation or magic-link email, and a page to choose a new password after a reset link. Point the email links at them. ``` Prompt ```text On sign-up, show the error the login service returns, if any. When it succeeds, say: "If that address is new, we've sent a link. Already signed up? Sign in or reset your password." Never say an email was sent when it wasn't. ``` ## Your builder’s guide Each one covers its own login options and settings: [Lovable](https://proxymail.qa/built-with/lovable), [Bolt](https://proxymail.qa/built-with/bolt), [v0](https://proxymail.qa/built-with/v0), [Replit](https://proxymail.qa/built-with/replit), [Base44](https://proxymail.qa/built-with/base44), [Antigravity](https://proxymail.qa/built-with/antigravity), [Cursor](https://proxymail.qa/built-with/cursor) and [Claude Code](https://proxymail.qa/built-with/claude-code). Not sure which login yours uses? [Login methods compared](https://proxymail.qa/built-with/login-methods). ## Automating this? Have your coding agent check the email itself: connect the Proxy Mail QA MCP server and ask it to sign up with a new address, wait for the code or link and finish the sign-up, as a user would. [Node.js client](https://proxymail.qa/docs/node) [Python](https://proxymail.qa/docs/python) [Set up your coding agent](https://proxymail.qa/docs/api#agent-setup) ## Try it on your next sign-up test Free plan, no credit card. Create an address and watch the code or link arrive. [Create a free account](https://app.proxymail.qa/?mode=signup&from=site-solve-vibe-coded-login-problems) ## Questions ### Why does sign-up work for me but not for anyone else? Usually because the app’s Supabase project still uses Supabase’s built-in email sender, which only emails members of your Supabase team, and you’re on it. Set up your own sender (custom SMTP, for example with Resend), then try again with an address that isn’t yours. ### My app says "Check your email" but nothing arrives. Where do I start? Sign up with a fresh Proxy Mail QA address. If nothing reaches its inbox, the email wasn’t sent: the address may already have had an account, email confirmation may be off, or the sender is refusing it. The app’s message is shown whatever happened, so it can’t tell you which. ### Should I switch email confirmation off to make testing easier? Not for an app other people will use. Without it, anyone can sign up with an address they don’t own. Keep it on and test it with addresses that receive mail. ### What should I ask the builder to fix first? The public address setting (Site URL), the sender, a page that finishes sign-in when the link is opened, and a page to choose a new password after a reset. The prompts below cover all four. ## Related guides - [Test sign-up and email verificationA fresh, private address for every sign-up test, with the verification link or code ready the moment it lands.](https://proxymail.qa/solve/email-verification-testing) - [Test OTP and one-time login codesCodes pulled out of the email with a Copy button and a countdown when the email says how long they last.](https://proxymail.qa/solve/otp-code-testing) - [Test magic links and passwordless sign-inSingle-use links that are never opened or prefetched on our side, so they still work when you click them.](https://proxymail.qa/solve/magic-link-testing) - [Test password reset emailsRequest, receive and use reset links, and keep the new password saved next to the test account.](https://proxymail.qa/solve/password-reset-testing) - [Stop sharing one Gmail inbox for QAPrivate, disposable addresses for every tester instead of one shared mailbox and a pile of plus-addresses.](https://proxymail.qa/solve/shared-test-inbox) - [Take QA notes by voice with Wispr FlowDictate what each test account is for, its state and what you found, straight into its notes, in seconds.](https://proxymail.qa/solve/voice-notes-wispr-flow) - [Verification link points to localhost:3000Why emails from staging link to localhost, how to fix it in Supabase, Firebase and other stacks, and how we flag it.](https://proxymail.qa/solve/localhost-links) - [Common Supabase sign-up and login problemsEmails that never arrive, links that expire or sign nobody in, and sign-ups that fail, with the fix for each.](https://proxymail.qa/solve/supabase-auth-problems) - [Common Firebase sign-up and login problemsMissing verification and reset emails, verified users who still look unverified, failing links and sign-up limits, with the fix for each.](https://proxymail.qa/solve/firebase-auth-problems) - [Test sign-up emails in PlaywrightA complete Playwright test for sign-up codes and links, from a fresh inbox to the report on the pull request.](https://proxymail.qa/solve/playwright-email-tests) - [Test sign-up emails in CypressA complete Cypress test for sign-up links and codes, with the email waits running as Cypress tasks.](https://proxymail.qa/solve/cypress-email-tests) - [Test sign-up emails with pytestA complete pytest test for sign-up codes and links, with Playwright for Python or Selenium and a one-file helper.](https://proxymail.qa/solve/pytest-email-tests) - [Test coupon codes and welcome offersThe coupon with its discount, end date and arrival time, what checkout did with it, and a failure when an expired or reused one is accepted.](https://proxymail.qa/solve/coupon-code-testing) - [Test unsubscribe links and one-click unsubscribeThe unsubscribe headers and link checked on every marketing email, and a watch that flags any marketing after unsubscribing, with no time limit.](https://proxymail.qa/solve/unsubscribe-testing) - [Test that a welcome offer can't be claimed twiceVersions of one address that reach the same inbox, and a check that fails when the same person got the offer more than once.](https://proxymail.qa/solve/welcome-offer-abuse) [Built your app with an AI tool? Pick yours](https://proxymail.qa/built-with) Lovable, Bolt, v0, Replit, Base44, Cursor and Claude Code are products of their owners. Proxy Mail QA is independent and isn’t affiliated with or endorsed by them.