convex-setup-auth

To set up Convex authentication, select a provider like Clerk or Auth0, wire the bindings in convex/auth.config.ts, and validate the login flow. This maps user identities and protects backend functions.

ctx.auth.getUserIdentity() enforces role-based access by validating authenticated user identities inside protected Convex queries and mutations. It retrieves the user identity from the configured auth provider to gate backend function execution.

Yes, you can use WorkOS AuthKit or custom JWT providers with Convex auth. The provider-agnostic wiring supports mapping user identities and configuring auth.config.ts for external identity providers.

The best way to add login and signup to a Convex app is selecting an auth provider, wiring auth.config.ts, and creating a users table with identity mapping. This establishes app-level user records for authentication.

You do not strictly need a users table just to require login, as validating ctx.auth.getUserIdentity() protects backend functions. However, creating a users table with identity mapping is required if the app needs app-level user records.

Convex auth configuration fails to protect backend mutations if you have not explicitly validated ctx.auth.getUserIdentity() inside the protected functions. Wiring auth.config.ts alone only maps identities without enforcing access control.