convex-setup-auth

To set up Convex authentication, you select a provider like Clerk or Auth0, install packages, update convex/auth.config.ts, and wire the client and backend to validate login and protected function access.

Convex auth works with WorkOS AuthKit and Auth0 by applying provider-specific references and wiring client and backend providers to ensure proper identity mapping and backend protection patterns.

The best way to configure access control in Convex is to automate identity mapping and protect backend functions by creating or updating convex/auth.config.ts and validating protected function access during onboarding.

You can use a custom JWT for Convex identity mapping by following provider-specific references, updating convex/auth.config.ts, and wiring the backend to validate authenticated flows and protected function access.

App-level user storage in Convex is needed when your onboarding requires persisting user identities beyond provider authentication, ensuring proper backend protection patterns and optional app-level user storage decisions.