Supabase
The project is healthy. The signup email and the webhook are not.
Supabase will serve the app while auth emails hit a rate limit, the redirect allow-list still says localhost, or an edge function dies before it answers Stripe.
Supabase is the default backend in a lot of generated apps: auth, database, and an edge function for the Stripe webhook. Each of those fails independently of the URL that serves the marketing page.
Watch the public URL for free. Map the signup or checkout once you have verified the domain, and read the auth-email guide before you invite real people.
What usually breaks
Redirect URLs that still allow only localhost
The magic link is sent, and the link points at a URL Supabase will not open. Authentication URL configuration has to include the production domain, and the site URL has to match it.
Auth email that never leaves the built-in mailer
The included mailer is rate-limited and is there so you can try auth. A launched app needs custom SMTP. Until then, the tenth signup of the day silently stops.
Row level security that rejects the insert
The UI says the row was saved. The policy on the table rejects the anon or authenticated role. The page does not read the error, so the customer sees success and you see an empty table.
Edge function timeout on the webhook
The function verifies the Stripe event and then does enough extra work to miss Stripe's window. The invocation log shows a timeout. The orders table never updates.
The anon key from a different project
The client was copied from a sample or another project. Auth requests hit the wrong project, which has none of your users and none of your redirect URLs.
Watch the next break before a customer does.
Free checks the public URL. Pro replays the path after you verify the domain.