How do I add user registration?

Ask Lovable to add sign-up with the fields and verification behaviour you want — it builds the form, creates the user in Lovable Cloud's auth system, and can store extra profile details in your database.

How do I add password reset?

Ask Lovable to add a "forgot password" flow — it uses Lovable Cloud's authentication to email a reset link and lets the user set a new password.

Why does my app keep redirecting to login?

This is almost always a session or route-guard bug: either the auth session isn't persisting, or a protected route checks auth state before it's loaded, so it bounces back to login even when signed in.

Why are verification emails not arriving?

Usually the email lands in spam, the sending rate limit on Lovable Cloud's default mailer has been hit, or you haven't connected a proper email provider yet.

How do I restrict pages to logged-in users?

Wrap the routes in a protected-route component that checks the current auth session and redirects signed-out users to login, and back this up with row-level security on any data those pages fetch.

How do I create admin users?

Add a `user_roles` table with an `admin` role, assign it to the specific user's ID, and check that role server-side (in RLS policies and any admin-only functions) rather than trusting a front-end flag.

How do I create different user roles?

Store roles in a dedicated `user_roles` table (never a column on the user's profile), and use a security-definer function to check roles inside RLS policies and route guards.

How do I build an admin dashboard?

Ask Lovable to build a role-gated route that lists and manages your data (users, orders, content), backed by RLS policies that only let accounts with the `admin` role query the underlying tables.

How do I prevent normal users accessing admin pages?

Guard the admin route with a check against the user's role from your `user_roles` table (not a front-end-only flag), and mirror that same check in RLS policies on any data the admin page loads.

How do I delete a user?

Ask Lovable to add an admin action that deletes both the user's auth account and their related data (profile rows, uploads, etc.), since removing one without the other leaves orphaned records or broken references.

How do I let users edit their profiles?

Add a profile form bound to a `profiles` table row keyed by the user's ID, with an RLS policy that only lets each user update their own row, not anyone else's.

How do I test authentication properly?

Test with real, separate accounts in a private browser window for each role (signed-out, normal user, admin), checking both the UI and that the underlying API/RLS actually blocks what it should — not just what the interface shows.

Why isn't my login working?

Q: How do I add login to Lovable?

Ask Lovable to add authentication — it enables Lovable Cloud (if not already on), then generates sign-up/login pages and wires them to email, Google, or other providers.

Q: How do I add Google login?

Ask Lovable to add Google sign-in — it can use Lovable's managed Google OAuth for a quick setup, or your own Google Cloud OAuth credentials if you need custom branding or scopes.

Last checked 31 Aug 2026

Short answer

Check the browser console for the actual error first — common causes are unconfirmed email, a redirect URL mismatch, RLS blocking the post-login profile read, or a provider (like Google) misconfigured for the current domain.

Diagnose before you guess

"Login isn't working" covers several different failures. Open the browser console and network tab and note the exact error before asking Lovable to fix anything.

Common causes

Email not confirmed. If your setup requires email verification, an unconfirmed account will fail to log in even with the correct password.
Wrong redirect URL. For Google/OAuth providers, the redirect URI configured for the provider must exactly match the domain you're testing on — this differs between your Preview URL and a published custom domain.
RLS blocking a post-login read. Login can succeed but the app then fails to load the user's profile because of a missing SELECT policy, making it look like "login doesn't work" when auth actually succeeded.
Testing on the wrong environment. A test/preview environment's auth users are separate from live/published ones — an account created on one won't exist on the other.
Session not persisting. If a user is logged in but gets bounced straight back to the login page, this is often a routing/protected-route bug rather than an auth problem.

Step-by-step

Open dev tools, try logging in, and read the exact error from the console/network tab.
Match the error to the categories above.
Ask Lovable with the specific error, not just "login is broken":

Login fails with a 403 right after auth succeeds, when the app tries to fetch the user's profile. Check the RLS policy on profiles for SELECT.

Test with a fresh account and an existing one, and on both preview and published URLs if relevant.

What usually goes wrong

Fixing the login form when the real issue is a database policy running afterwards.
Not re-testing OAuth providers after adding a custom domain.
Assuming a bug is universal when it only affects one environment (test vs live) or one provider (email works, Google doesn't).

If login issues persist after checking all of the above, a fresh pair of eyes from PromptSites.com can be faster than continued trial and error.

Related: /questions/how-do-i-add-login-to-lovable, /questions/how-do-i-add-google-login, /questions/why-is-supabase-returning-a-403-error.

Sources

Was this answer helpful?