Bolt.new app not working after deploy: 8 fixes

October 15, 2026 · 10 min read

You built the app in Bolt.new. The in-browser preview looks perfect: login works, data loads, every page opens. Then you hit Publish, or export to GitHub and connect Netlify or Vercel, and something is wrong. Blank white page. Login that bounces to localhost. Build log that says Module not found. Published URL that shows Bolt's default page instead of your app.

This guide covers the eight causes we see most often when a Bolt app "stops working" after deploy. Work top to bottom. Most apps need only one or two of these fixes. If your problem is specifically Supabase login or empty tables, also read Supabase auth redirect and RLS. If the build itself is red on Vercel with a Next.js project, start with Module not found.

Step 0: decide whether the build failed or the live app misbehaves

Open the host's deploy log first.

Build failed (red): the problem is in install, TypeScript, imports or Node version. Jump to fixes 1–4.
Build succeeded, live site wrong: the problem is env vars, redirects, SPA routing, CORS or RLS. Jump to fixes 5–8.

Then open the live URL in Chrome, press F12, and note the first red Console error and any failed Network requests. Copy them exactly. Asking Bolt or Cursor to "fix the deploy" without that evidence usually rewrites working code.

1. Module not found / unresolved import

Signature: deploy log shows Could not resolve "./components/Button", Module not found: Can't resolve '@/lib/utils', or ENOENT for a file that exists on your laptop.

Three Bolt-specific traps:

File never left the sandbox. Bolt's editor can show a file that was never written to the GitHub export. Confirm the path exists in the repo on github.com, not only in the Bolt UI.
Case mismatch. macOS forgives ./Components/Button vs ./components/button. Linux build servers do not. Make the import match the file name exactly.
Path alias without config. @/ imports need vite.config (or tsconfig paths) committed. If the alias only lived in Bolt's ephemeral config, the host cannot resolve it.

# Confirm locally before redeploying
npm ci
npm run build

Fix the first error only. Commit the missing file or corrected import, push, and let the host rebuild.

2. Lockfile / package manager mismatch

Signature: install step fails with peer dependency errors, or the host picks npm while Bolt used pnpm or bun.

Bolt projects sometimes ship more than one lockfile (package-lock.json, pnpm-lock.yaml, bun.lockb). Hosts guess the package manager from whichever lockfile they find first. Keep one lockfile, delete the others, commit it, and set the install command explicitly in the host (for example Netlify: npm ci, or Vercel Project Settings → Install Command).

3. Node version drift

Signature: build fails on modern syntax, or an old OpenSSL / Vite error that does not reproduce locally.

Pin Node so the host matches what Bolt used:

// package.json
"engines": { "node": "20.x" }

On Vercel you can also set the Node version in Project Settings → General. On Netlify, set NODE_VERSION=20 in the environment, or add an .nvmrc file containing 20.

4. TypeScript errors the preview ignored

Signature: tsc fails during npm run build with string | undefined, missing props, or unused locals treated as errors.

Bolt's live preview is forgiving. Production builds often run tsc -b or vite build with stricter settings. Run the build locally, fix real null checks instead of spraying as any, and only then ask the AI to help — with the exact error pasted in.

5. Blank white page: missing environment variables

Signature: white screen; console shows supabaseUrl is required, Invalid URL, or undefined is not a function.

Bolt's preview injects secrets for you. Netlify and Vercel do not. Vite only exposes names that start with VITE_, and it inlines their values at build time.

VITE_SUPABASE_URL=https://abcdefgh.supabase.co
VITE_SUPABASE_ANON_KEY=eyJhbGciOiJIUzI1NiIs...

Search the project for import.meta.env. and note every name.
Add each variable in the host for Production and Preview.
Trigger a new deploy. Editing env vars does not patch an old build.

Full checklist: Environment variables missing in production.

6. Login redirects to localhost or the email link expires

Signature: after sign-in you land on http://localhost:5173, or the magic link says it is invalid.

In Supabase → Authentication → URL Configuration:

Set Site URL to your live origin (https://myapp.com).
Add Redirect URLs for production, previews and local dev, for example https://myapp.com/** and https://*.netlify.app/**.

In code, stop hard-coding localhost:

await supabase.auth.signInWithOAuth({
  provider: "google",
  options: { redirectTo: `${window.location.origin}/auth/callback` },
});

Test in an incognito window. Details: Supabase auth redirect and RLS.

7. Refreshing a deep link returns 404

Signature: home page works; reloading /dashboard shows the host's 404.

Vite + React Router apps have one real file, index.html. Production hosts need a rewrite:

// vercel.json
{ "rewrites": [{ "source": "/(.*)", "destination": "/index.html" }] }

# Netlify: public/_redirects
/*  /index.html  200

# Apache
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^ /index.html [L]

If you stay on Bolt Hosting and deep links already work, you can skip this. The moment you export to Netlify or Vercel, add the rewrite.

8. Logged in but every list is empty (RLS)

Signature: no console errors; queries return []; inserts say new row violates row-level security policy.

Supabase Row Level Security is on (good) but the table has no policies, or inserts omit user_id. Add policies scoped to auth.uid(). Do not disable RLS and do not put the service_role key in the browser. See the RLS section in our Supabase guide.

Bolt Hosting vs export: which path are you on?

Bolt offers its own publish flow and a GitHub export. They fail differently:

Bolt Hosting / Publish: check Bolt's deployment panel for build logs, confirm secrets are set in Bolt's project settings, and confirm the custom domain DNS points where Bolt tells you.
Export → Netlify/Vercel: you own env vars, rewrites, Node version and lockfiles. The eight fixes above apply in full.

If the published URL still shows a Bolt marketing page, DNS or the publish step did not finish. Wait for DNS, open the exact deploy URL from the dashboard, and only then debug the app.

A post-publish checklist for Bolt apps

npm run build passes on a clean clone.
One lockfile is committed; install command matches it.
Node is pinned to 20.x (or whatever Bolt used).
Every VITE_ variable is set on the host and you redeployed after adding them.
Supabase Site URL and Redirect URLs include the live domain.
SPA rewrite exists on Netlify/Vercel.
No localhost left in src/ (grep -rn localhost src).
RLS policies exist for every browser-facing table.
Sign-up, login, create and delete tested in incognito on the live URL.

How to prompt Bolt so it does not make things worse

The live site at https://myapp.com shows this console error on load:
  Uncaught Error: supabaseUrl is required. (client.ts:6)
It works in the Bolt preview. Do NOT change UI or refactor.
First explain the cause in 2 sentences, then propose the smallest fix.

If the answer is a hosting setting (env vars, redirect URLs, rewrite), no code change will help. Stop the model from editing files.

FAQ

Why does my Bolt.new app work in preview but not after publish?

The Bolt preview injects secrets, allows localhost redirects and proxies API calls. After you publish to Netlify, Vercel or Bolt Hosting, those crutches disappear. Missing VITE_ env vars, unapproved Supabase redirect URLs and SPA rewrite rules are the usual causes.

Why is my Bolt deploy failing with Module not found?

A file was never committed, an import path has the wrong case for Linux, or a package lives only in your local node_modules. Run npm run build locally, fix the first red error, commit every referenced file and redeploy.

Does Bolt Hosting need a vercel.json rewrite?

Bolt Hosting handles SPA routing for many Vite apps, but if you export to Netlify or Vercel you must add a rewrite to index.html yourself. Without it, refreshing /dashboard returns a 404.

Is it safe to put the Supabase anon key in a Bolt frontend?

Yes, the anon key is meant to be public, but only if Row Level Security is enabled with real policies. Never put the service_role key in client code.