How to verify BaseBuddy sign-in setup
Confirm local password sign-in, invite return paths, and safe redirects for a BaseBuddy install.
BaseBuddy uses local password sessions stored in app data. It does not require Supabase-hosted authentication for app sign-in.
Use this guide when users cannot sign in, invite links return to the wrong page, or a setup owner wants to confirm the login flow after deployment.
Confirm an owner user exists
Run:
shpnpm basebuddy doctor --skip-db-checkThe Owner account and Environment values sections should be ready.
If no user exists, create one:
shpnpm basebuddy user:create \
--email "owner@example.com" \
--name "Owner" \
--password "choose-a-strong-password"Test password sign-in
Open:
texthttps://cms.example.com/loginUse the email and password saved during setup. Successful sign-in should open /projects or the safe internal page you originally requested.
BaseBuddy only accepts internal return paths such as:
text/projects
/invite/<token>It does not redirect to arbitrary external URLs after sign-in.
Test invites
Invite links look like:
texthttps://cms.example.com/invite/<token>Ask the recipient to open the invite and sign in with the same email address used on the invite. After sign-in, BaseBuddy should return to the invite page and finish acceptance.
If the recipient lands on Projects instead, send a fresh invite and confirm they used the same browser for the invite and sign-in flow.
Legacy callback routes
The app still has /auth/callback and /auth/confirm routes so old links fail safely back to login. They are not active OAuth or magic-link sign-in routes in the current local password model.
Common problems
| Problem | What it usually means | What to do |
|---|---|---|
| Every sign-in fails | The user is missing, the password is wrong, or app data changed | Create/reset the local user and rerun doctor |
| Invite opens Projects | The return path was missing, unsafe, expired, or tied to another email | Send a fresh invite and use the invited email |
| Sign-in works locally but not after deploy | Production cannot read the same app data | Preserve basebuddy-data/ or use Supabase/Postgres app data |
| Browser shows an auth callback error | An old OAuth or magic-link URL was opened | Return to /login and use password sign-in |
For setup diagnostics, use How to fix failed setup checks.