How to Deploy a Lovable App to Production: Step-by-Step

You have a working Lovable prototype. Now you need it live, with a custom domain, real users, and your data locked down. Lovable's built-in hosting works for demos. For anything beyond that, you export to GitHub and pick a deployment platform. The choice between managed platforms (Northflank, Kuberns), going self-hosted, or staying on Lovable Cloud depends on your ops tolerance and stage. We'll walk through each path, the technical gotchas that bite most developers, and how to cost it.

Before You Export: Security Checks That Prevent 99% of Production Failures

Honest stat: 170 out of 1,645 Lovable apps had live security vulnerabilities in a recent audit (CVE-2025-48757). Most of these were caught pre-deployment. Before you export your app to GitHub, you need to look for three things: Row-Level Security rules that are broken, secrets in your environment variables that are hardcoded, and database exports that failed silently.

Start with your database. Open your Lovable Cloud database settings and check if RLS (Row-Level Security) is enabled. Lovable's interface shows this clearly. If you're exporting that database to Supabase or another provider, RLS policies often break in transit. Test the export first in a staging environment. Download a backup, spin it up locally with Docker, and run a query as two different authenticated users. If both see each other's rows, your RLS is broken.

Next, audit your environment variables. Anything that looks like a secret should not be in your Lovable app code. Things like API keys, database passwords, and OAuth client secrets belong in your host platform's secrets store, not in .env or baked into your build. Go through your app's settings tab and list every variable. For each one, ask: "Would I be comfortable if a customer saw this?" If the answer is no, move it to the deployment platform's secrets manager.

Finally, check your Lovable Cloud database size. Lovable enforces a 5 GB limit and allows one export every 24 hours. If you're at 4.8 GB or higher, you're one day of growth away from being stuck. Start shrinking now: delete old test records, archive unused tables, or migrate historical data elsewhere. Then schedule your first real export 24 hours before your production launch. No surprises on launch day.

The Three Deployment Paths: When Lovable Cloud, When GitHub Export, When Managed

Three real options exist. Each has a cost, effort, and ops burden. No single path is correct for everyone. The decision tree is simple: how much DevOps work do you want to do, and at what stage are you launching?

Path 1: Stay on Lovable Cloud. Lowest friction, zero DevOps, but fixed constraints and no custom backend. The cost depends on your plan tier; Lovable doesn't publish pricing per-user, only per-plan. Custom domains are a paid feature. This path works for internal tools, prototypes, and early-stage side projects with under 1,000 monthly active users.

Path 2: GitHub export to a managed platform. You export your Lovable app as a full-stack Next.js project, push it to GitHub, and deploy to Vercel, Netlify, Northflank, Kuberns, or similar. This unlocks custom backends, unlimited scale, and real databases. Deployment is automated from Git. Managed platforms handle SSL, monitoring, and uptime. Cost ranges from $0 (free tier with limits) to $50/month for a small production app. This is the fastest path to production.

Path 3: Self-hosted on your own infrastructure. You export to GitHub, set up Docker, and run the app on a VPS (DigitalOcean, Hetzner, AWS) with a tool like Coolify. Full control, lowest raw cost, but you own the ops burden: SSL certificates, backups, monitoring, and on-call. Expect to spend 6-12 hours setting this up if you haven't done it before.

Most first-time launchers pick Path 2. It balances speed to market with just enough control. Revisit this decision when you're profitable and ops becomes a real cost center.

Path 1: Stay on Lovable Cloud (When It's Actually Fine)

Don't be ashamed of this choice. Lovable's hosting works. The built-in database is Supabase, scaled for concurrent users. You get automatic SSL, a generous uptime SLA, and zero deployment friction. You do the work. Lovable handles the rest.

Limitations are real and worth stating: 5 GB database limit, one export per 24 hours, no custom backend logic, no environment-specific configs, RLS policies that are fragile on export, and no ability to self-host if you ever decide to leave Lovable. You're buying convenience and betting that Lovable's roadmap aligns with yours.

Costs are opaque. Lovable's pricing page shows tiers but not the cost of custom domains or higher database limits. Email their sales team to quote. Most early-stage apps fit in the $30-100/month range if you add custom domain features.

Stay on Lovable Cloud if: you're building an internal tool, your user count is under 1K monthly active, you don't need a custom API, and you're okay with Lovable's pricing opacity. Leave if: you need a custom backend, you're planning to hit 10K+ monthly active users, you want to control your own database, or you're uncomfortable with vendor lock-in.

Path 2: GitHub Export to Managed Platform (Fastest to Production)

This is the path most builders take. Here's the step-by-step.

Step 1: Export from Lovable. In Lovable's app settings, click "Export to GitHub." Lovable will walk you through creating a GitHub token and confirm your repo location. Your app exports as a Next.js project with Dockerfile, environment variable scaffolding, and a start script in package.json. This takes 2-5 minutes.

Step 2: Choose a platform and sign up. Northflank, Kuberns, and Vercel are the three most beginner-friendly options. Vercel is zero-config if you stick with Next.js defaults. Kuberns starts at $7/month and includes $14 in credits for 30 days, so your first month is free. Northflank's free tier includes two services, one database, and two cron jobs. Pick one and create an account.

Step 3: Connect your GitHub repository. The platform will ask for permission to read your GitHub repo. Authorize it. The platform will auto-detect that this is a Next.js app and configure a build pipeline.

Step 4: Set environment variables. The tricky part. Your Lovable app needs NEXT_PUBLIC_SUPABASE_URL and NEXT_PUBLIC_SUPABASE_ANON_KEY if you're using the default Supabase database. You also need SUPABASE_SERVICE_ROLE_KEY for server-side RLS bypasses. Get these from your Supabase project settings. Paste them into the platform's secrets manager. Do not paste them into your repo.

Step 5: Deploy. Click "Deploy" or "Create Service." The platform will clone your repo, install dependencies, build your Next.js app, and start it. This takes 3-10 minutes. Once it's done, you'll get a generated URL for your app. Test it by loading the site and clicking through a few flows.

Step 6: Bind a custom domain. Go to the platform's domain settings, add your domain (you own via GoDaddy, Cloudflare, etc.), and follow the DNS instructions. Add an A record and CNAME record as specified. DNS propagates in 5 minutes to 48 hours. Most platforms auto-provision an SSL certificate from Let's Encrypt once DNS resolves.

Step 7: Update Supabase Site URL. This is critical and often missed. Go to your Supabase project settings, find "URL Configuration," and add your new custom domain as an allowed redirect URL. If you don't do this, OAuth flows will break with "redirect_uri mismatch" errors. Lovable usually pre-populates this, but verify.

Total time: 30-45 minutes. Total cost for a small app: $0-20/month (depending on the platform's free tier).

Path 3: Self-Hosted (DIY + Full Control)

You own the infrastructure, the database, and every config. Cost is lower, but ops work is real.

You'll need: a VPS ($5-20/month, e.g., Hetzner, DigitalOcean, Linode), Docker (to containerize your app), a reverse proxy like nginx, and Coolify or similar (optional, simplifies deployment).

Basic flow: export your Lovable app to GitHub, SSH into your VPS, pull the repo, build the Docker image, run the container on port 3000, and proxy traffic through nginx on port 80. Add a cron job for backups. Point DNS to your VPS IP. Provision an SSL cert from Let's Encrypt.

If you've done this before, 2-3 hours. If not, 1-2 days, plus reading Docker and nginx docs.

Raw cost wins vs. managed platforms: a $5/month Hetzner VPS handles 1-10K monthly active users cheaply. A managed platform at that scale costs $20-50+/month. But you're paying the ops tax: monitoring, backup scripts, security patches, on-call presence.

Self-host if: you're cost-conscious, you have existing DevOps experience, or you want full control over your infrastructure and data. Skip it if: this is your first production app, you'd rather ship than tinker, or your time is worth more than $15/month.

We've published a detailed walkthrough on how to self-host a Lovable app with Coolify and Docker examples.

The TanStack/Nitro Discovery & Deployment Issues You'll Hit

Lovable generates a Next.js codebase with some quirks. Developers hit the same issues repeatedly on deployment.

Issue 1: TanStack Query and the start script. Lovable generates a package.json with start: next start. On some platforms, the start script doesn't exist or is misconfigured. The container starts, logs look fine, then the app 404s when you visit it. Fix: Explicit entry point in your Dockerfile. Tell the platform: CMD ["npm", "run", "start"]. Verify it runs locally first: npm run build && npm run start, then test your app running locally.

Issue 2: Environment variable discovery at build time vs. runtime. Lovable's generated code sometimes assumes NEXT_PUBLIC_* variables are available at build time. They should be injected at runtime in a managed environment. If your custom domain suddenly shows "undefined" API calls, your environment variables didn't populate. Double-check the platform's secrets: did you actually save them, or did you close the dialog?

Issue 3: Nitro backend adapter failures. Lovable uses Nitro under the hood for server-side logic. On some platforms (particularly older Node versions), the Nitro adapter doesn't initialize. Symptom: API routes return 500. Fix: Check your platform's supported Node versions. Lovable targets Node 18+. Force your platform to use Node 18 or higher in your deployment config.

Issue 4: Database connection pooling. If your Supabase database gets too many connections at once, it closes older ones, and you see "too many connections" errors. Lovable doesn't set connection pooling by default. In your Supabase settings, enable PgBouncer (connection pooling), and update your connection string to use the pooling URL instead of the standard URL. This costs $5 more per month in Supabase, but it prevents crashes as your traffic grows.

All four of these are in your logs. Read your deployment logs carefully. A few minutes of debugging here saves hours later.

Post-Deployment: Custom Domains, OAuth Redirects, Monitoring

Your app is live. Now make sure it stays live.

Custom domains and SSL: Once your domain's DNS propagates, verify that your domain works with both HTTP and HTTPS. HTTP should redirect to HTTPS automatically (your platform does this). If it doesn't, your deployment is misconfigured.

OAuth redirects: If your app uses Google, GitHub, or other OAuth providers, those providers have a strict list of allowed redirect URLs. Your domain followed by a callback path (typically /auth/callback or /callback) is what they'll expect. Go to each OAuth provider's settings and add your production domain URL. Lovable usually pre-populates test URLs; you need to add the production ones.

Uptime and error monitoring: Set up a simple uptime check. Ping your app every 5 minutes from an external service (Uptimerobot is free). If it goes down, you get an email. Add error tracking (Sentry's free tier is generous) so you see crashes before your users do.

Database backups: If you're on a managed platform, your database is usually backed up automatically. Verify this in your dashboard. If you're self-hosted, automate backups to S3 or similar. One corrupted production database is a career-ending event.

Cost Comparison: Which Path Wins for Your Stage

Dollar amounts matter to founders. Here's the real cost breakdown:

For your first launch, pick managed. You're betting your time is valuable. At $50/month on Northflank, you get 1-2 years of low-touch hosting before self-hosting makes financial sense. Revisit when you're profitable.

Frequently Asked Questions

Can Lovable be used to make mobile apps?

No. Lovable generates web apps (Next.js). You can wrap a web app in a mobile shell (Capacitor, React Native Web), but Lovable doesn't export native iOS/Android code. If you need mobile, Lovable's not the right tool.

Can Lovable deploy to the App Store?

No, for the same reason. Lovable builds web first. You could theoretically package your web app as a PWA and list it in app stores, but that's a niche workflow.

How do I export a Lovable app?

In Lovable's app settings, click "Export to GitHub." Authorize GitHub, pick your repo name, and Lovable pushes your codebase. This is a one-way export; changes to your Lovable app don't sync back to GitHub.

Can you build a full app with Lovable?

Yes, with caveats. Lovable's good at frontends and simple backends. Complex multi-service architectures are harder. Most single-founder SaaS apps fit within Lovable's scope.

Can you monetize Lovable apps?

Yes. There's no restriction on commercial use. You own the exported code. Lovable's terms don't take a cut.

How to publish a Lovable app?

Export to GitHub, deploy to a managed platform or your own infrastructure, bind a custom domain, and go live. This guide walks through all of it.

The Bottom Line

Your Lovable prototype is production-ready if you secure your database, test your environment variables, and pick the right deployment platform. Most founders should export to GitHub and deploy to Northflank or Kuberns in under an hour. Lovable Cloud works for demos; real apps need their own infrastructure.

The cost difference between paths is small enough to not matter on day one. What matters is shipping. Pick managed, launch, and migrate to self-hosted later if the math justifies it.

Ready to move from prototype to production? Check out our migration checklist to ensure you haven't missed anything before you export.