Skip to main content
Your app’s built-in backend (Cloud) includes authentication. Ask Lovable to add login, and it generates the signup and login pages, wires them to your backend, and protects user data with row level security. For example, tell Lovable:
The Users view lets you manage the people who sign up and configure how they sign in. To open it, go to More → Cloud → Users.

​
Manage users

The Users view shows a Signups chart of new users over the last 7, 30, or 90 days, and a searchable list of every user in your app. To add users yourself, click Add user:
  • Send invitation: enter an email address and Lovable sends the person an invite email to join your app.
  • Create new user: enter an email address and password to create the account directly. Users created this way are automatically confirmed.
Click a user to open their details, including their user ID, sign-up and last sign-in timestamps, and which login methods they use. The Raw JSON tab shows the full user record. To remove a user, open their details and choose Delete user. The user loses access to your app, and the action cannot be undone.

​
Authentication settings

Click Auth settings in the Users view to configure how users sign in. The Sign in methods list shows each available method with an Enabled or Disabled badge. You can change these settings directly, or ask Lovable in chat. When you enable a sign-in method, Lovable can also update your app’s login page, for example by adding the matching sign-in button.
On Business and Enterprise workspaces, admins can block sign-in methods for all projects in the workspace with the App login methods setting (Settings → Security → Privacy & security → App login methods). The policy controls what you can change in your project’s auth settings: you cannot enable a method the policy blocks, and a blocked method that was already enabled can still be disabled, but not enabled again. Locked methods show a Workspace policy badge.
Building an internal tool for your own workspace members? Apps can recognize the signed-in workspace member with no login page at all. See Reuse Lovable workspace identity.
Each sign-in method has its own page with full configuration details:
  • Email: the default method, with settings for confirmation, password rules, one-time codes, and sending limits.
  • Phone: SMS one-time codes through your own SMS provider (Twilio, Twilio Verify, TextLocal, Vonage, or MessageBird).
  • Google: managed by Lovable with no setup, or your own Google Cloud OAuth credentials.
  • Apple: managed by Lovable, or your own Apple Developer credentials.
  • Microsoft: managed by Lovable with no setup, or your own Azure app registration.
  • SAML SSO: sign-in through a SAML 2.0 identity provider such as Okta or Microsoft Entra ID.

​
Sign-up controls

Two settings on the main auth settings form control who can join your app:
  • Disable sign-up: prevent new users from signing up. Existing users can still sign in, and you can still add users with Add user.
  • Enable anonymous users: let visitors use your app without creating an account. Ask Lovable in chat to build flows that use anonymous sessions, such as guest checkouts.

​
Site URL and redirect URLs

Under Advanced in the auth settings:
  • Site URL: the default URL users are redirected to after authentication when no redirect URL is specified.
  • Redirect URLs: up to 50 URLs that auth providers are permitted to redirect to after authentication. Custom schemes (for example, myapp://callback) are supported for mobile apps.
For apps on the built-in backend (Cloud), Lovable keeps both up to date for you. When you publish, Lovable sets the Site URL to your published lovable.app address, and when you connect a custom domain, Lovable adds it to the redirect URLs. A Site URL you set yourself stays unchanged. Apps that use your own Supabase project get no automatic updates, so add the addresses in that project’s auth settings. If sign-in works in preview but breaks on your published app or custom domain, these URLs are usually the reason. Ask Lovable in chat to update them for your domain.

​
Auth emails

Authentication flows send emails for signup confirmation, password resets, invites, magic links, email changes, and re-authentication. By default they come from a generic sender. To send them from your own domain with custom branding, set up Emails under More → Cloud. See Custom emails.

​
FAQ

No. Google, Apple, and Microsoft sign-in work in Managed by Lovable mode, where Lovable handles the OAuth configuration and security updates. You only need your own credentials if you want the consent screen to show your own branding and verified domain.
Yes. On Business and Enterprise workspaces, admins can block sign-in methods for every project in the workspace with the App login methods setting (Settings → Security → Privacy & security → App login methods). Blocked methods are locked: project owners can turn them off but cannot turn them back on.
No. Remixing copies the structure of backend data, such as tables and auth configuration, but not the data itself. The remixed project starts with no users.
The published URL or custom domain is missing from your project’s redirect URLs. For apps on the built-in backend (Cloud), Lovable adds these addresses automatically when you publish and when you connect a custom domain. If sign-in still fails, or your app uses your own Supabase project, ask Lovable in chat to add your domain to the auth redirect URLs, or add it under Auth settings → Advanced → Redirect URLs.