---
title: Introduction
description: Convex-native auth for production apps.
---

Convex-native auth for production apps. Users, sessions, identities, organizations, API keys, webhooks, and MCP auth live in your Convex database. No external auth service required.

If you are new here, follow this order:

1. **Install**

    Add the packages, generate signing keys, and set environment variables.

2. **Quickstart**

    Wire `convex/auth.ts`, mount the component, set up the React client, and sign up a user.

3. **Understand the concepts**

    The five building blocks: component, config, actions, HTTP routes, and React client.

4. **See the architecture**

    How `convex-auth` is designed around Convex's runtime.

## Get started

**[Installation](/convex-auth/installation)**

Install packages and set the minimum environment variables.

**[Quickstart](/convex-auth/quickstart)**

End-to-end setup with email/password and OAuth.

**[Concepts](/convex-auth/concepts)**

Component, config, actions, HTTP routes, and React client.

**[Architecture](/convex-auth/architecture)**

How `convex-auth` is designed around Convex's runtime.

## Select your framework

Setup varies by framework — pick yours for the end-to-end guide.

**[React](/convex-auth/react)**

Vite SPA client — `ConvexAuthClientProvider` and hooks.

**[TanStack Router](/convex-auth/tanstack-router)**

Client-side route guards with router context.

**[React Native / Expo](/convex-auth/react-native)**

Native apps with secure token storage.

**[Next.js](/convex-auth/nextjs)**

SSR auth with HttpOnly cookie sessions and middleware.

**[TanStack Start](/convex-auth/tanstack-start)**

SSR auth with request middleware and server functions.

**[Hono](/convex-auth/hono)**

Server adapter for Bun, Node, and Workers-style runtimes.

## Core auth

**[Email and password](/convex-auth/email-password)**

Sign-up, sign-in, email verification, and password reset.

**[OAuth](/convex-auth/oauth)**

Google, GitHub, and Discord sign-in.

**[Generic OAuth](/convex-auth/generic-oauth)**

Any OIDC/OAuth2 provider — Azure, Apple, your own IdP.

**[Two-factor](/convex-auth/two-factor)**

TOTP and backup codes.

**[Passkeys](/convex-auth/passkeys)**

WebAuthn passkey sign-in.

**[Magic links](/convex-auth/magic-links)**

Password-less email sign-in.

**[Email OTP](/convex-auth/email-otp)**

One-time email passcodes.

**[Anonymous](/convex-auth/anonymous)**

Guest sessions that upgrade into real accounts.

## Application features

**[Organizations](/convex-auth/organizations)**

Multi-tenant workspaces, members, roles, and invitations.

**[API keys](/convex-auth/api-keys)**

Create, rotate, and revoke service API keys with scoped IP ranges.

**[Service principals](/convex-auth/service-principals)**

Non-human identities for CI, automation, and agents.

**[OIDC provider](/convex-auth/oidc-provider)**

Turn your app into an identity provider — powers MCP OAuth for agents.

**[Webhooks](/convex-auth/webhooks)**

Signed webhook events for lifecycle and org changes.

**[Theming](/convex-auth/theming)**

Light, dark, system mode, design tokens, and per-component styling.

## UI components

Drop-in UI for every feature above — forms, pages, surfaces, and primitives, for React and React Native. Theme them once, ship them everywhere.

**[React](/convex-auth/components/react/sign-in)**

Sign-in, organizations, account, API keys, webhooks, security — the full library.

**[React Native](/convex-auth/components/react-native)**

Expo screens and org components built on secure storage and deep links.

## Operations

**[Security](/convex-auth/security)**

2FA, CAPTCHA, breach checks, rate limits, and keys.

**[Production](/convex-auth/production)**

Deploy, monitor, and rotate.

**[Testing](/convex-auth/testing)**

Test helpers, the conformance consumer, and CI setup.

**[Preflight](/convex-auth/preflight)**

Validate your auth setup before deploying.

**[Troubleshooting](/convex-auth/troubleshooting)**

Diagnostics, bug reports, and common mistakes.

## Reference

**[Configuration](/convex-auth/configuration)**

Every option on `convexAuth`.

**[Server API](/convex-auth/server-api)**

Actions, queries, and HTTP routes.

**[Per-feature components](/convex-auth/feature-gated-components)**

Install only the auth features you use — the component mount table.

**[Consumer contract](/convex-auth/consumer-contract)**

Public entrypoints and rules for consuming the package.

## Migrations

If you already have an auth integration:

- [Migrating from Better Auth](/convex-auth/migrating-from-better-auth)
- [Migrating from Clerk](/convex-auth/migrating-from-clerk)
- [Migrating from WorkOS](/convex-auth/migrating-from-workos)
- [Migrating to per-feature components](/convex-auth/migrating-to-feature-gated-components)
- [Migrating to v3](/convex-auth/v3-migration)