Why is my Bolt.new app not working after deploy?

In Bolt's preview, everything works. You publish, open the live address, and something is wrong: a blank page, a login that goes nowhere, a page that says 404 when you refresh it, or data that never loads.

This is one of the most common frustrations with AI app builders, and it's rarely a mystery. The preview and the live site run in different places with different settings. Almost every "works in preview, broken after deploy" problem comes down to a setting that exists in one place and not the other.

Below are the causes we see most, roughly in order of how often they happen, with a fix for each.

First: where is your app actually hosted?

Bolt's documentation says new projects are published with Bolt hosting by default, which gives you a bolt.host address. You can also choose Netlify as the host, by connecting your Netlify account before the first publish. Some people also download the code and deploy it to Vercel or Netlify themselves.

Which one you use changes where the settings live, so check before you start fixing. If your address ends in .bolt.host, it's Bolt hosting. If it ends in .netlify.app, it's Netlify. For a custom domain, look in Bolt's publish settings or in your Netlify or Vercel dashboard.

Then rule out an outage: check Netlify's status if you host there, and Supabase's status if your app uses Supabase. If the platform is down, wait — nothing below will help.

Step 1: Open the browser console

Open the live site on a computer, right-click, choose Inspect, then the Console tab, and reload. Red errors tell you what failed. Then check the Network tab for requests in red. Keep the first error handy; it tells you which of the sections below applies.

Cause 1: Environment variables didn't reach the live site

Symptoms: a blank page; console errors like supabaseUrl is required or something about a variable being undefined; API calls going to undefined/rest/v1/....

Your app reads settings like the Supabase address, the publishable key, or a Stripe publishable key from environment variables. In Bolt's editor those exist. On a separate host, they may not.

• Hosted on Netlify (including via Bolt's Netlify integration): Netlify's guide for Bolt apps says the variables you set in Bolt don't appear in Netlify automatically. In Netlify, go to Site configuration → Environment variables and add each one with exactly the same name and value. Then trigger a new deploy — the values are built into the app at build time, so a variable added after the last build does nothing until you rebuild.
• Deployed to Vercel yourself: same idea, in Project → Settings → Environment Variables, then redeploy.
• Check the prefix. Bolt apps are usually built with Vite. Vite only puts variables that start with VITE_ into the browser code. A variable named SUPABASE_URL is invisible to the browser; it must be VITE_SUPABASE_URL (or whatever name your code reads). If your project uses Next.js instead, the browser-visible prefix is NEXT_PUBLIC_.

One important warning: only public values belong in browser variables. A Supabase publishable (anon) key or a Stripe publishable key is fine. A Stripe secret key, an OpenAI key or a Supabase service_role key must never have a VITE_ prefix — anything with that prefix is readable by every visitor. See what to do about an exposed API key.

Cause 2: Sign-in redirects to the preview, or fails

Symptoms: you click "Sign in with Google" or a magic link and end up on a Bolt preview address, localhost, or an error page; or sign-in works in preview but not live.

Supabase Auth only sends people back to addresses you've allowed. Supabase's docs describe two settings under Authentication → URL Configuration:

• Site URL — the default address users are sent back to. For production, set it to your live address, for example https://yourapp.com.
• Redirect URLs — an allow list of other addresses your app may redirect to. Add your live address (and your bolt.host or netlify.app address if people use it).

If you use Google sign-in, Google's settings for your OAuth client also list allowed redirect addresses; the one Supabase gives you must be there. And if your app passes a redirectTo in code, it must match an allowed address exactly.

After changing these, try signing in from a private window, so old sessions don't hide the result.

Cause 3: Pages work from the home page but 404 on refresh

Symptoms: the home page works; clicking around works; but opening yourapp.com/dashboard directly or pressing refresh gives "Page not found".

Bolt apps are usually single-page apps: one index.html, with the app deciding what to show for each address. The host has to send every address to that file. If it doesn't, it looks for a real file called /dashboard, doesn't find one, and shows a 404.

• On Netlify: add a file public/_redirects containing /* /index.html 200, then redeploy. (Files in public are copied as-is into the built site.)
• On Vercel: add a rewrite in vercel.json that sends all paths to /index.html.

You can ask Bolt to do it: "Add the SPA fallback for Netlify so every route serves index.html."

Cause 4: The build fails or produces an old version

Symptoms: your changes don't show up live; the host's deploy log shows a failure; or the live site is an older version.

Open the deploy log on the host (Netlify: Deploys → the latest deploy). A failed build keeps the previous version online, which is why it can look like "my changes didn't publish".

Common reasons:

• A TypeScript or lint error that the preview tolerated but the production build doesn't. The log shows the file and line; paste it into Bolt and ask it to fix the build error.
• Wrong publish directory. Netlify's guide says a Vite build outputs to dist. If the host is set to publish a different folder, it serves nothing useful.
• A missing dependency that was installed in the editor but isn't in package.json. The log says a module can't be found; ask Bolt to add it properly.

Cause 5: The database is fine in preview but empty or locked live

Symptoms: lists are empty, saving fails with a permission error, or the console shows a 401 or 403 from Supabase.

• Make sure the live site points at the same Supabase project as the preview. It's easy to end up with two projects and different variables.
• If you recently turned on Row Level Security (RLS) or the AI added policies, a query that worked might now be blocked. That's often the right behavior — tables should have RLS on — but the policies need to allow what your app legitimately does. Ask Bolt: "This query returns a permission error for logged-in users. Add the RLS policy that lets users read their own rows."
• If requests time out entirely, your Supabase project may be paused. See Supabase project paused.

Cause 6: Payments or webhooks still point at the preview

If you take payments with Stripe, check your webhook endpoint in Stripe's dashboard. Webhooks registered while you were testing may point to a preview or test address. Your live site needs its own endpoint, and live mode uses different keys than test mode.

A short prompt that fixes most of these

When you're not sure which cause it is, give Bolt the evidence:

My app works in preview but not on the live site (<your live URL>).
The browser console shows: <first red error>
The failing request is: <URL and status code>
The site is hosted on <Bolt hosting / Netlify / Vercel>.
Find the cause and fix it. If it's a missing environment variable, tell me the exact name to add to the host.

How to catch "broken after deploy" right away

The worst version of this problem is when you publish, check the home page, and leave — while sign-in or a deeper page is broken for hours.

Pingbuddy notices when you publish: on every check it compares your app's JavaScript and CSS files, and when they change it runs a full check right away, including a real browser that looks for a blank page or an error on screen. If something broke, the alert starts with "You published an update 4 minutes ago — and your site broke." It's free for up to 20 sites, checked every 5 minutes.

You can also run a free checkup of your live site now: it looks for keys left in public code, SSL and domain expiry, slow responses and a paused Supabase project.

Checklist

• Know your host (bolt.host, Netlify, Vercel) and check its status.
• Console first: copy the first red error.
• Environment variables: added on the host, correct prefix, rebuilt after adding.
• Supabase Auth: Site URL and Redirect URLs include your live address.
• 404 on refresh: add the SPA fallback.
• Build log: fix the error it shows; check the publish directory.
• Supabase: same project, sensible RLS policies, not paused.
• Stripe: live keys and a live webhook endpoint.