AI-scaffolded Next.js apps often work on localhost and then log users out on the first production visit. The UI looks fine. The session is gone. Nine times out of ten the bug is cookie config, middleware refresh, or a Preview/Production env mismatch — not "Supabase is down."

Use this checklist before you point real users at the deploy.

1. Match cookie domain to the real host

If the app lives on app.example.com , the auth cookie domain has to cover that host. A cookie set for localhost or a bare apex while users hit a subdomain looks like a random logout after deploy.

Check:

Production host vs cookie Domain

Whether you need a leading-dot parent domain for subdomains

That Preview deployments are not accidentally writing Production cookie settings

2. Use Secure + SameSite correctly

Production must set Secure cookies over HTTPS.…