Every guide to Lovable authentication wires a login into a blank project. This one is for the app that already has users, and the four failures that show up the week they arrive.
Google login started bouncing to the preview URL the day your domain went live. Sign-ups stopped getting their confirmation email. A customer wants an admin who can see their whole team, and an investor just asked whether you have two-factor. None of those is a Lovable problem, exactly. Lovable Cloud runs on Supabase Auth underneath, so every one of them is a Supabase setting the prompt box never mentioned.
Here is the short version. The app does not need rebuilding. Authentication in a Lovable app is a handful of configuration decisions plus one database policy per table, and they can be fixed in place, in an afternoon or a week depending on which ones got skipped, without logging out a single existing user. This page goes through them in the order that stops the bleeding first.
One thing before the detail. If you have under a hundred users, take no payments and hold nothing personal, read the section on who does not need to touch any of this and probably stop there. We would rather say that now than three sections in.
