convex-setup-auth

Adding authentication to Convex starts with choosing a provider such as Convex Auth, Clerk, WorkOS AuthKit, or Auth0, then configuring convex/auth.config.ts and wrapping the client with the matching provider. Protect backend functions by calling ctx.auth.getUserIdentity() and rejecting unauthenticated requests.

Convex Auth handles auth directly inside Convex and manages user records internally, while Clerk provides hosted auth features and suits apps already using Clerk. Choose based on existing dependencies and whether you want auth managed in Convex or by a third party.

Convex supports Auth0 and WorkOS AuthKit through JWT validation configured in convex/auth.config.ts. Auth0 uses Auth0Provider with ConvexProviderWithAuth0, while AuthKit setup is driven by a convex.json authKit section and WorkOS environment variables.

Convex reporting unauthenticated after a successful provider login usually means auth.config.ts is misconfigured or the backend config was not synced. Re-run the Convex dev or deploy flow, verify the issuer domain, and confirm the provider integration was activated.

Add a users table in Convex only when the app needs first-class user records beyond authentication gates. Convex Auth manages user records internally, so a parallel users table with a storeUser flow is unnecessary for that provider.