---
changelog:
  category: Release
  version: 2.0.4
date: '2026-09-10T13:47:16Z'
seo:
  description: >-
    Remove module-scope JWT private-key/JWKS caching so rotated keys take effect
    immediately and warm processes cannot sign with stale material.Add the
    missing…
title: convex-auth v2.0.4
type: changelog
---
## What's changed
- Remove module-scope JWT private-key/JWKS caching so rotated keys take effect immediately and warm processes cannot sign with stale material.
- Add the missing `convex/auth.config.ts` native Convex auth provider wiring in the OAuth demo.
- Share the pending 2FA challenge token through `ConvexAuthProvider` context so the sign-in page and reusable verification form stay in sync.
- Improve `toError` in `convex-auth-client.ts` to preserve string/object messages.
- Increase JWT `iat` future-clock skew leeway.
- Update `mintOAuthState` for the new `getJwtPrivateKey` return shape and include the key id in the header.
- Clean up demo lint warnings and harden forgot/reset/verify-email response handling.

## Verification
- `pnpm run check`, `typecheck`, `build`, `test` (1275 tests), `lint`, `lint:convex`, `scan:secrets` all pass locally.
- `convex-auth check` and `convex-auth preflight` pass for `examples/oauth`.
- Browser (Safari MCP): 2FA TOTP sign-in, backup codes, sessions, API keys, service principals + verify-as-session, webhooks, audit, and preflight UI all verified.