How to Deploy a Lovable App to Production (Without It Breaking)
A production deployment checklist for Lovable apps: custom domains, environment variables, Supabase configuration, and the failures that only appear after going live.
Lovable's Publish button gets you a live URL. It does not get you a production app. The gap between the two is where most Lovable projects die — and where paying customers hit errors your demo never showed.
Here's the checklist I run when taking a Lovable app to real production.
1. Domain and URLs
- Connect your custom domain (Project → Settings → Domains) and wait for DNS + SSL to go green.
- Then update every place that stored the old URL: Supabase Auth → URL Configuration (Site URL + redirect URLs), OAuth providers (Google/GitHub callback URLs), and Stripe webhook endpoints. Auth "works on the lovable.app URL but not on my domain" is almost always a stale redirect URL (Google login fix).
2. Environment variables and secrets
Lovable manages Supabase keys for you, but anything else — Stripe keys, email API keys, third-party tokens — must be checked:
- No secrets in frontend code. Anything in the React code ships to every visitor. Search for
sk_live,service_role, and API keys. - Secret keys belong in Supabase Edge Function secrets (or your backend host's env vars), never in the client.
- Test keys (
sk_test_...) must be swapped for live keys — in the server environment, not the code.
3. Supabase production configuration
This is the big one. Before real users arrive:
- Row-level security on every table, with policies. ~70% of Lovable apps ship with RLS disabled (full guide here) — that's your entire database public.
- Auth settings: disable auto-confirm if you don't want fake signups; configure a real SMTP provider (the built-in email service is rate-limited and lands in spam — email setup guide).
- Backups: confirm point-in-time recovery or at minimum daily backups are enabled on your Supabase plan.
4. Payments
- Stripe webhook endpoint pointing at the production domain, with the production signing secret (common failures here).
- Run one real live-mode transaction end to end: pay, webhook received, order recorded, email sent, refund works.
5. The things nobody thinks about until they hurt
- Error visibility: by default you'll never know production is broken until a customer emails you. Add error tracking (e.g. Sentry) — Lovable apps ship with none.
- SEO / indexability: Lovable apps are client-side rendered; Google may see an empty page (why, and the fix).
- Rate limiting & abuse: public forms and endpoints will be found by bots within days.
- A rollback plan: know how to get back to the last working version before you need to.
When the deploy itself keeps failing
Build errors after connecting GitHub, blank white pages on the custom domain, infinite loading — these usually trace back to environment differences, not the code the AI wrote last. The fastest path is a root-cause diagnosis rather than another 50 prompts.
That's my Hardening & Deploy package: environments, CI/CD, monitoring, OWASP + RLS hardening, and your app live on your domain — $1,799 fixed. Or start with the $299 triage to find out exactly what stands between your demo and production.
Stuck? I'll fix it for a fixed price.
I'm a senior full-stack engineer who audits, fixes, hardens, and deploys broken Lovable, Bolt, Cursor, v0, and Replit apps. Fixed price — diagnose before I touch a line of code, so you stop burning credits on prompts that make it worse.
Vibe-Code Rescue — from $299