Introduction
Convex-native auth for production apps.
Convex-native auth for production apps. Users, sessions, identities, organizations, API keys, webhooks, and MCP auth live in your Convex database. No external auth service required.
If you are new here, follow this order:
Install
Add the packages, generate signing keys, and set environment variables.
Quickstart
Wire convex/auth.ts, mount the component, set up the React client, and sign up a user.
Understand the concepts
The five building blocks: component, config, actions, HTTP routes, and React client.
See the architecture
How convex-auth is designed around Convex’s runtime.
Get started
Installation
Install packages and set the minimum environment variables.
Quickstart
End-to-end setup with email/password and OAuth.
Concepts
Component, config, actions, HTTP routes, and React client.
Architecture
How convex-auth is designed around Convex’s runtime.
Select your framework
Setup varies by framework — pick yours for the end-to-end guide.
React
Vite SPA client — ConvexAuthClientProvider and hooks.
TanStack Router
Client-side route guards with router context.
React Native / Expo
Native apps with secure token storage.
Next.js
SSR auth with HttpOnly cookie sessions and middleware.
TanStack Start
SSR auth with request middleware and server functions.
Hono
Server adapter for Bun, Node, and Workers-style runtimes.
Core auth
Email and password
Sign-up, sign-in, email verification, and password reset.
OAuth
Google, GitHub, and Discord sign-in.
Generic OAuth
Any OIDC/OAuth2 provider — Azure, Apple, your own IdP.
Two-factor
TOTP and backup codes.
Passkeys
WebAuthn passkey sign-in.
Magic links
Password-less email sign-in.
Email OTP
One-time email passcodes.
Anonymous
Guest sessions that upgrade into real accounts.
Application features
Organizations
Multi-tenant workspaces, members, roles, and invitations.
API keys
Create, rotate, and revoke service API keys with scoped IP ranges.
Service principals
Non-human identities for CI, automation, and agents.
OIDC provider
Turn your app into an identity provider — powers MCP OAuth for agents.
Webhooks
Signed webhook events for lifecycle and org changes.
Theming
Light, dark, system mode, design tokens, and per-component styling.
UI components
Drop-in UI for every feature above — forms, pages, surfaces, and primitives, for React and React Native. Theme them once, ship them everywhere.
React
Sign-in, organizations, account, API keys, webhooks, security — the full library.
React Native
Expo screens and org components built on secure storage and deep links.
Operations
Security
2FA, CAPTCHA, breach checks, rate limits, and keys.
Production
Deploy, monitor, and rotate.
Testing
Test helpers, the conformance consumer, and CI setup.
Preflight
Validate your auth setup before deploying.
Troubleshooting
Diagnostics, bug reports, and common mistakes.
Reference
Configuration
Every option on convexAuth.
Server API
Actions, queries, and HTTP routes.
Per-feature components
Install only the auth features you use — the component mount table.
Consumer contract
Public entrypoints and rules for consuming the package.
Migrations
If you already have an auth integration: