Interface: MutationAuth

For AI agents: see llms.txt for the complete documentation index. Markdown versions are available by adding .md to a page URL or requesting Accept: text/markdown.

server.MutationAuth

Auth for mutations, which can also sign JWTs with this deployment's key.

Hierarchy

• Auth

  ↳ MutationAuth

Methods

getUserIdentity

▸ getUserIdentity(): Promise<null | UserIdentity>

Get details about the currently authenticated user.

Returns

Promise<null | UserIdentity>

A promise that resolves to a UserIdentity if the Convex client was configured with a valid ID token, or if not, will:

• returns null on Convex queries, mutations, actions.
• throw on HTTP Actions.

Inherited from

Auth.getUserIdentity

Defined in

server/authentication.ts:236

---

signJwt

▸ signJwt(options): Promise<string>

Sign an ES256 JWT with this deployment's key.

Pass the claims and expiresInSeconds values that match your use case.

Convex populates the header and sets the iss, iat and exp claims.

The iss is process.env.CONVEX_CLOUD_URL for the app and ${process.env.CONVEX_CLOUD_URL}/components/<name> for a component.

Anyone can verify these tokens against the public keys at ${process.env.CONVEX_CLOUD_URL}/.well-known/jwks.json.

Claims are signed but not encrypted, so anyone holding the token can read them.

Prefer short token lifetimes: a token can't be revoked individually, and a mutation can always sign a fresh one to reassert the claims. This API allows a token to have a max expiration of 1 hour from issuance.

Claims that start with convex or cvx (case insensitive) and the nbf claim are reserved and may not be set.

Parameters

Name	Type
options	SignJwtOptions

Returns

Promise<string>

Defined in

server/authentication.ts:269