Convex Auth HTTP API
The HTTP surface served by the convex-auth component at
https://<your-deployment>.convex.site. Browser clients consume it
through cookies; SSR adapters (Next.js, TanStack Start) proxy it on the
app’s own origin; React Native and token-mode clients consume it
directly with bearer tokens.
Redirect-bearing parameters (callbackURL, errorURL, newUserURL,
newUserCallbackURL, errorCallbackURL, redirectTo) are validated
against SITE_URL/CONVEX_SITE_URL plus any configured
trustedOrigins. Untrusted values are rejected with a 400 or an error
redirect — never silently followed.
Endpoints that write session cookies enforce CSRF via Fetch Metadata / Origin checks; cross-site POSTs are rejected with 403.
https://{deployment}.convex.siteSession
Read, rotate, and destroy sessions.
- GETResolve the session cookie to a user
/api/auth/session - GETAlias of `/session`
/api/auth/get-session - POSTRotate a refresh token into a new session pair
/api/auth/update-session - POSTRevoke the session and clear cookies
/api/auth/sign-out
Credentials
Email/password sign-up, sign-in, and password reset.
- POSTCreate an account with email and password
/api/auth/sign-up/email - POSTSign in with email and password
/api/auth/sign-in/email - POSTAlias of `/sign-in/email`
/api/auth/sign-in - POSTAlias of `/sign-up/email`
/api/auth/sign-up - POSTRequest a password-reset email
/api/auth/request-password-reset
OAuth
Social sign-in initiation and provider callbacks.
- POSTBegin an OAuth sign-in and return the provider authorization URL
/api/auth/sign-in/social - GETBegin an OAuth sign-in via a plain GET navigation
/api/auth/signin/{provider} - GETOAuth provider callback (registered redirect URI)
/api/auth/callback/{provider}
Verification
Email verification and magic-link landings.
- GETVerify a magic-link token and land on the app
/api/auth/magic-link/verify - GETValidate a password-reset token and land on the app
/api/auth/reset-password/{token} - GETVerify an email address token
/api/auth/verify-email - POSTSend an email-verification message
/api/auth/send-verification-email
Two-Factor
TOTP enrollment, challenge, and backup codes.
- POSTBegin TOTP enrollment
/api/auth/two-factor/enable - POSTComplete a TOTP challenge
/api/auth/two-factor/verify-totp - POSTComplete a challenge with a one-time backup code
/api/auth/two-factor/verify-backup-code - POSTDisable two-factor authentication
/api/auth/two-factor/disable - POSTMint a fresh set of backup codes
/api/auth/two-factor/generate-backup-codes
OIDC
JWT/JWKS material for ctx.auth.getUserIdentity().