Take a Lovable prototype to production (auth, email, deploy)

A Lovable preview is a demo. Production is a URL that stays up when someone on your waitlist clicks Sign up at midnight. The gap is usually auth, email delivery, env secrets, and hosting, not more screens.

#1. Freeze the one journey that must work

Before you polish animations, write down the path that proves the product: sign up, verify email, land in an empty dashboard, create one object, see only your own data. Everything else is backlog. Skip this and you ship a pretty shell with a broken first session.

#2. Auth that survives a hard refresh

• Supabase Auth with email/password or OAuth. Pick one primary path for the MVP.
• Confirm the session comes back on reload (Lovable plus supabase-js with your project URL and anon key).
• Protect routes. Unauthenticated users go to login. Authenticated users shouldn't hit an auth gate that loops forever.

#3. Email verification that actually sends

Default Supabase email is fine for early tests, then you hit rate limits or spam folders. Before you show clients, connect custom SMTP (Resend, etc.) in Supabase Auth settings. Test the verify link on a phone that isn't already logged in.

Checklist I run before launch:
[ ] Sign up with a fresh inbox
[ ] Click verify on a different device
[ ] Password reset works
[ ] OAuth callback URL matches production domain
[ ] RLS enabled on every user table

#4. Env vars and secrets

Put NEXT_PUBLIC_SUPABASE_URL and NEXT_PUBLIC_SUPABASE_ANON_KEY (or the Lovable equivalents) in your host's environment. Never commit service-role keys. Stripe secrets and webhook secrets stay server-side. If the MVP takes money, wire test mode first. Flip live keys only after a successful test checkout.

#5. Deploy somewhere boring

I usually ship Lovable-derived apps on Vercel with a custom domain. Connect GitHub, set env vars, deploy to production, then run the same auth checklist on the production URL. Preview URLs lie about OAuth callbacks and cookie domains.

• Add the production site URL to Supabase Auth redirect allow-list.
• Confirm HTTPS and that www vs apex matches your canonical host.
• Hand over: GitHub access, env list (names only in docs), schema notes, and “what breaks if X”.

#What I ship as a Lovable AI MVP

When clients hire me for idea-to-live scope, they get a production URL and the repo, not another preview. If the prototype exists but auth or deploy is on fire, that's rescue work on the Lovable Developer page. Same stack, different starting point.