Getting started

Finding the correct redirect URL

On platforms like Lovable or Base44, you usually build in a temporary preview sandbox first, then publish to a stable URL. Hosted login only succeeds when the callback address is on your application’s redirect allowlist — and that address is different for preview vs published.

The redirect URL is required for security: after login, secureFlows will only send the user back to addresses you have explicitly allowlisted, so a stolen login flow cannot be redirected to an attacker’s site.

This walkthrough uses Lovable with secureFlows. The same pattern applies to Base44 and most other AI app builders.

1. Create an application with a placeholder redirect

In Workspace Management, create a new application. Set an application ID you’ll reuse in your builder prompt (for example simple-app). For the redirect URI, start with a dummy value such as http://placeholder.com — you’ll replace it once the platform shows you the real callback URL.

New application dialog with a placeholder redirect URI — Register the app with a placeholder redirect URI so you can finish setup later.

2. Build the app in Lovable using that application ID

In Lovable (or Base44), describe your app and tell the AI to integrate secureFlows. Pass the same workspace and appId you just created.

Lovable prompt including workspace and appId simple-app — Point the builder at the secureFlows skill and your real workspace / appId.

3. Try signing in — copy the URL from the error

Open the preview app and create or sign in as a user. Because the placeholder isn’t the real callback host, secureFlows rejects the redirect and shows an error that includes the exact URL to allowlist. Copy that URL from the message.

Sign-in error showing the preview redirect URI to add to the allowlist — The error is intentional: it tells you the preview callback URL to add (often a `*.lovableproject.com/callback` host).

4. Edit the application in Workspace Management

Go back to the Applications list, find your app, and open Edit.

Applications list with Edit highlighted for the new app — Edit the application you registered in step 1.

5. Add the preview redirect URI

Paste the URL you copied into Redirect URIs, click Add, then Update. Keep the placeholder for now if you like — you can remove it later.

Redirect URIs list with placeholder and preview callback URL — Allowlist the preview callback alongside (or instead of) the placeholder.

6. Sign in again — the preview app should work

Return to the Lovable preview and sign in. Hosted login should complete, and your app can store and show user data through secureFlows.

Working app form after successful secureFlows sign-in — After the preview URI is allowlisted, login succeeds and the app can save data.

7. Publish the app, then repeat for the final URL

When you publish, the platform usually assigns a new stable host (for example *.lovable.app). The preview callback no longer matches — try signing in once more and copy the new URL from the allowlist error, just as in step 3.

Sign-in error showing the published app redirect URI to allowlist — Publishing changes the callback host — secureFlows will tell you the new URL to add.

8. Add the published URL and clean up

Edit the application again and add the published callback URI. Keep the preview URI for future debugging. You can remove http://placeholder.com once both real URLs are on the list.

Redirect URIs with placeholder, preview, and published callback URLs — Final allowlist: preview + published callbacks. Drop the placeholder when you no longer need it.

Done Preview and production (or published) hosts can both stay allowlisted. That way you can keep iterating in the sandbox without breaking the live app.

Next: Build your First Application · Applications · Platform-hosted apps