Skills

Skill 4 of 33

Convex Auth

Add authentication (passkeys/OAuth) to the current Convex app, including the auth.config.ts wiring.

2 minutes · 430 words · 3 sections

Install

$ npx skills add get-convex/agent-skills --skill convex-auth

$ npx skills add get-convex/agent-skills

The first command installs just this skill, by the name in its SKILL.md; the second installs the whole repository.

Install and wire @convex-dev/auth for the current app: a provider (passkeys by default, or OAuth/password), the server config, the client hooks, and a sign-in UI — correctly, including the auth.config.ts that’s the #1 real-world auth footgun.

Workflow

Install @convex-dev/auth (pinned build) and add it to convex.config.ts. With pnpm, also pnpm add jose (it won’t hoist otherwise); you need it for step 3.
Add the provider in convex/auth.ts (Passkey by default; Password or OAuth like Google on request).
Generate the auth keys HEADLESSLY. Do NOT run the interactive npx @convex-dev/auth wizard: it needs a login/TTY and hangs in non-interactive, anonymous, or CI runs (the #1 auth time-sink). Generate JWT_PRIVATE_KEY + JWKS deterministically with jose: node -e ‘import(“jose”).then(async({generateKeyPair,exportPKCS8,exportJWK})=>{const k=await generateKeyPair(“RS256”,{extractable:true});const priv=await exportPKCS8(k.privateKey);const pub=await exportJWK(k.publicKey);process.stdout.write(JSON.stringify({JWT_PRIVATE_KEY:priv.trimEnd().replace(/\n/g,” “),JWKS:JSON.stringify({keys:[{use:”sig”,…pub}]})}))})’ > .auth-keys.json Then set JWT_PRIVATE_KEY and JWKS (from .auth-keys.json) plus SITE_URL on the deployment. Prefer the Convex MCP envSet tool, one call per var, to avoid shell-quoting the multi-line key. CLI fallback: use the NAME=VALUE form (npx convex env set "JWT_PRIVATE_KEY=$JWT"), NEVER env set JWT_PRIVATE_KEY "$JWT" (the value starts with -----BEGIN and the CLI parses the leading - as an unknown flag). SITE_URL is the dev URL (e.g. http://localhost:3000 (opens in a new tab)). Delete .auth-keys.json after.
Write convex/auth.config.ts (the silently-always-signed-out bug lives here if it’s wrong).
Wire the client: ConvexAuthProvider, the sign-in component, and route guards. If you import shadcn/ui primitives (button, input, textarea, label, and so on), add them first with npx shadcn@latest add <name>; a missing @/components/ui/* is a hard build error.
Verify a sign-in round-trips before declaring done.

Rules

Generate JWT_PRIVATE_KEY/JWKS with jose (extractable RS256; PKCS8 newlines to spaces; JWKS = {keys:[{use:”sig”, …publicJwk}]}). Do NOT run the interactive npx @convex-dev/auth wizard: it hangs headless/anonymous. Set the vars via the MCP envSet tool or the NAME=VALUE CLI form.
Always write auth.config.ts: a missing/incorrect one makes the app silently always-signed-out with no error.
Passkeys by default; only switch to password/OAuth on explicit request.
Install any shadcn/ui primitive you import up front (npx shadcn@latest add ...); a missing @/components/ui/* is a hard build failure.
Verify a real sign-in works before finishing.

Colophon for this issue

Colophon

How this issue was made

Source

github.com/get-convex/agent-skills, branch main, last pushed 9 September 2026.

Licence

Apache-2.0 — the text of every skill is reproduced unmodified, frontmatter included, under the upstream licence.

Discovery

33 skills found by walking the repository tree for SKILL.md, not by matching a directory convention. One layout observed: skills/*/SKILL.md.

Issue colours

Resolved from a deterministic hash of the owner name. Two accent tones are generated per issue and each is proven against its own ground before it ships: a single accent that passes AA on both light and dark paper is arithmetically impossible.

Heading repairs

1 repair applied to this skill so the document has one h1 and no skipped levels:

Shifted “3 headings” from h1 to h2 so the skill title is the only h1.

Spec compliance

Every skill satisfies the Agent Skills specification’s frontmatter rules.

Images

Images inside a skill come from the upstream repository. Where the author gave no alternative text we mark the image decorative rather than inventing a description — a plausible caption we made up is worse than none for the reader who depends on it.

Signal

Install counts come from skills.sh. They measure downloads, not quality, and an unranked repository is not an unread one.

Agent surfaces

The whole issue is available as one markdown document at /get-convex/agent-skills.md, and each skill at its own .md URL.

Publication

Set by Skills Docs from the source repository. Body text is Literata at the reader’s chosen size and measure; code is Geist Mono. Nothing on this page was written by us except this paragraph.

Add sign-in to the app

Install @convex-dev/auth (pinned build) and add it to convex.config.ts. With pnpm, also pnpm add jose (it won’t hoist otherwise); you need it for step 3.

Add the provider in convex/auth.ts (Passkey by default; Password or OAuth like Google on request).

Generate the auth keys HEADLESSLY. Do NOT run the interactive npx @convex-dev/auth wizard: it needs a login/TTY and hangs in non-interactive, anonymous, or CI runs (the #1 auth time-sink). Generate JWT_PRIVATE_KEY + JWKS deterministically with jose: node -e ‘import(“jose”).then(async({generateKeyPair,exportPKCS8,exportJWK})=>{const k=await generateKeyPair(“RS256”,{extractable:true});const priv=await exportPKCS8(k.privateKey);const pub=await exportJWK(k.publicKey);process.stdout.write(JSON.stringify({JWT_PRIVATE_KEY:priv.trimEnd().replace(/\n/g,” “),JWKS:JSON.stringify({keys:[{use:”sig”,…pub}]})}))})’ > .auth-keys.json Then set JWT_PRIVATE_KEY and JWKS (from .auth-keys.json) plus SITE_URL on the deployment. Prefer the Convex MCP envSet tool, one call per var, to avoid shell-quoting the multi-line key. CLI fallback: use the NAME=VALUE form (npx convex env set "JWT_PRIVATE_KEY=$JWT"), NEVER env set JWT_PRIVATE_KEY "$JWT" (the value starts with -----BEGIN and the CLI parses the leading - as an unknown flag). SITE_URL is the dev URL (e.g. http://localhost:3000). Delete .auth-keys.json after.

Write convex/auth.config.ts (the silently-always-signed-out bug lives here if it’s wrong).

Wire the client: ConvexAuthProvider, the sign-in component, and route guards. If you import shadcn/ui primitives (button, input, textarea, label, and so on), add them first with npx shadcn@latest add <name>; a missing @/components/ui/* is a hard build error.

Verify a sign-in round-trips before declaring done.

Generate JWT_PRIVATE_KEY/JWKS with jose (extractable RS256; PKCS8 newlines to spaces; JWKS = {keys:[{use:”sig”, …publicJwk}]}). Do NOT run the interactive npx @convex-dev/auth wizard: it hangs headless/anonymous. Set the vars via the MCP envSet tool or the NAME=VALUE CLI form.

Always write auth.config.ts: a missing/incorrect one makes the app silently always-signed-out with no error.

Passkeys by default; only switch to password/OAuth on explicit request.

Install any shadcn/ui primitive you import up front (npx shadcn@latest add ...); a missing @/components/ui/* is a hard build failure.

Verify a real sign-in works before finishing.