Question 1

Authentication not working

Accepted Answer

First, check that your authentication provider (Google, email/password, etc.) is enabled in Supabase Authentication → Providers. Then verify redirect URIs are correctly configured in Supabase Authentication → URL Configuration. Use the Cloud tab → Logs to check for specific error messages. If using Google OAuth, confirm your OAuth Client ID and Secret are correctly entered in Supabase. For complex issues, use Plan mode to investigate before retrying.

Question 2

Can I add third-party APIs to my project?

Accepted Answer

Yes, use Supabase Edge Functions to securely call third-party APIs. Store API keys in Cloud → Secrets (never paste in chat). Prompt Lovable to add the integration: 'Add a feature that calls the Stripe API to get customer data.' Lovable generates the Edge Function and UI.

Question 3

Ensure domain authentication is valid

Accepted Answer

For email sending, verify your domain ownership by configuring SPF, DKIM, and DMARC records as provided by Resend. These DNS records prove you control the domain and intent to send emails. Invalid or missing records cause emails to land in spam or fail delivery. Double-check record values in your DNS provider.

Question 4

How do I configure authentication in Supabase?

Accepted Answer

Enable authentication in Supabase's Authentication → Providers section. Choose your methods: email/password, Google OAuth, social providers, etc. For Google OAuth, provide your OAuth Client ID and Secret from Google Cloud Console. Set redirect URLs in Supabase Authentication → URL Configuration (include localhost:3000 for dev). Lovable can auto-scaffold the sign-in UI when you ask.

Question 5

Can I switch between "managed" and "your own credentials" later?

Accepted Answer

Yes, you can switch authentication methods later. If you start with Lovable-managed auth and want to switch to your own credentials, you'll need to configure a Google OAuth app in Google Cloud Console and update the credentials in Supabase Authentication → Providers → Google. Existing user sessions will continue to work, but new sign-ins will use the new credentials.

Question 6

Consent screen issues

Accepted Answer

If users see Google's consent screen unexpectedly, it's usually because the OAuth consent screen in Google Cloud Console hasn't been fully configured or published. Verify your app name, logo, and scopes are set in Google Cloud Console, then test in an incognito window to see the fresh consent flow. If using Lovable-managed Google auth, these details are handled for you automatically.

Question 7

Do I need to configure Google Cloud Console when using "Managed by Lovable" setup?

Accepted Answer

No, with Lovable-managed Google authentication, Lovable handles the Google Cloud Console setup for you. You don't need to create an OAuth app or manage credentials yourself. If you choose to use your own credentials instead, then you'll need to set up a project in Google Cloud Console, create OAuth credentials, and provide the Client ID and Secret to Supabase.

Question 8

Do users see the Google consent screen every time they sign in?

Accepted Answer

No, users typically see the consent screen only once—the first time they sign in with Google. After they consent, their browser stores the OAuth token and they sign in immediately on subsequent visits. If you deploy to a new domain or change scopes, users may see the consent screen again.

Question 9

Is the Lovable-managed Google authentication available for all Lovable apps?

Accepted Answer

Lovable-managed Google authentication is available as a feature, but you can also choose to use your own Google OAuth credentials through Supabase's standard setup. With Lovable-managed authentication, Lovable handles the Google Cloud Console configuration for you—no need to set up your own OAuth app. You can switch between managed and your own credentials anytime.

Question 10

Should I use the managed by Lovable option or my own credentials?

Accepted Answer

Use Lovable-managed authentication if you want a quicker setup with no Google Cloud Console configuration. Use your own credentials if you need specific control over OAuth settings, multiple apps sharing one Google project, or custom consent screen messaging. Both approaches are equally secure—choose based on your preference for convenience vs. control.

Question 11

What information does Google share with my app?

Accepted Answer

Google shares the user's basic profile information through OAuth, including email, name, and profile picture (if the scope includes it). The exact data depends on which scopes you request when prompting Lovable to add authentication. You can control what Supabase requests—common scopes are email and profile. Google's privacy policy governs how their data is handled.

Question 12

Wrong OAuth client type

Accepted Answer

You need an OAuth 2.0 Web Application client, not a Desktop or Mobile client. In Google Cloud Console, go to Credentials → Create Credentials → OAuth 2.0 Client ID and select Web Application. Add your redirect URIs (like http://localhost:3000/auth/callback and your production domain), then copy the Client ID and Secret to Supabase Authentication → Providers → Google.

Question 13

Authorization flow issues

Accepted Answer

Authorization flow problems usually stem from mismatched Redirect URIs, incorrect Issuer URLs, or provider credentials. Double-check that your Redirect URI, Client ID, and Client Secret are correct in both Lovable and your SSO provider. Clear browser cookies and try a fresh login. Test with Plan mode to identify the exact failure point.

Question 14

Can I enforce SSO for my workspace?

Accepted Answer

Enterprise plans can enforce SSO for the entire workspace, blocking non-SSO login methods. This setting must be configured by your workspace admin or support team. Once enforced, all workspace members must authenticate via your SSO provider. Contact support@lovable.dev to enable SSO enforcement for your Enterprise workspace.

Question 15

Can I use SCIM without SSO?

Accepted Answer

No, SCIM (System for Cross-domain Identity Management) is used in conjunction with SSO to automate user provisioning and deprovisioning. You must have SSO configured first. SCIM syncs user data and group memberships from your identity provider automatically, but it requires an active SSO connection.

Question 16

Does Lovable support IdP-initiated SSO?

Accepted Answer

Yes, Lovable supports IdP-initiated SSO, allowing users to start their login from your identity provider's dashboard. This requires proper ACS URL and audience configuration in your SAML provider. IdP-initiated flows are especially useful for Enterprise users who access apps from a central identity portal.

Question 17

Does Lovable support SCIM or automatic user provisioning?

Accepted Answer

Yes, Lovable Enterprise plans support SCIM (System for Cross-domain Identity Management) for automatic user provisioning and deprovisioning. SCIM syncs user accounts, group memberships, and role assignments from your identity provider in real-time. Contact support@lovable.dev to enable SCIM for your workspace.

Question 18

Does Lovable support just-in-time (JIT) provisioning with SSO?

Accepted Answer

Yes, Lovable supports JIT provisioning, which automatically creates user accounts on their first SSO login. No pre-provisioning step needed. The user's email and basic profile data are captured from the SSO provider during first login. JIT is ideal for teams with frequent user changes and simplifies admin overhead.

Question 19

Does Lovable support multiple SSO providers per workspace?

Accepted Answer

Currently, Lovable supports one SSO provider per workspace. If you need to support multiple providers (e.g., Okta for some teams, Azure AD for others), contact your Enterprise account manager to discuss options. For smaller organizations, consider consolidating identity management in a single provider.

Question 20

Email claim missing

Accepted Answer

Your SSO provider must be configured to include the email claim in its token response. In your provider's configuration (Okta, Azure AD, etc.), ensure the email attribute is mapped to the email claim. Without it, Lovable cannot create user accounts. Check your SSO provider's attribute mapping or claims configuration.

Authentication

Authentication & APIs

Google Authentication

SSO & Enterprise Auth

Pronto(a) para criar?