convex-nextjs-dual-environment-secrets

Your Convex webhook returns Unauthorized because the secrets are missing or mismatched in the Convex environment. Synchronizing secrets ensures both Next.js and Convex share identical values to resolve authentication failures.

To sync environment variables, add the INTERNAL_API_SECRET to your Next.js .env.local file and mirror the exact same value in your Convex environment variables. Redeploy both environments to apply the changes.

Cross-environment authentication failures are caused by missing or mismatched secrets between Next.js API routes and Convex mutations. Explicit synchronization requires aligning the INTERNAL_API_SECRET across both local and Convex environments.

Verify synchronized secrets by redeploying or refreshing both Next.js and Convex environments, then trigger a small test mutation. If the authentication succeeds, the INTERNAL_API_SECRET values match correctly across environments.

Yes, you must redeploy or refresh both Next.js and Convex after updating environment variables. Applying secret changes to both environments ensures the new values are loaded before you verify authentication succeeds.