multiple auth providers

[next ruin]

is this true the auth provider can have multiple providers, can you find examples in discord?

// convex/auth.config.ts
import type { AuthConfig } from "convex/server";

const clientId = process.env.WORKOS_CLIENT_ID;

export default {
  providers: [
    // Clerk OIDC
    {
      domain: process.env.CLERK_JWT_ISSUER_DOMAIN!, // from Clerk "convex" JWT template
      applicationID: "convex",
    },
    // WorkOS AuthKit custom JWT
    {
      type: "customJwt",
      issuer: `https://api.workos.com/`,
      algorithm: "RS256",
      applicationID: clientId,
      jwks: `https://api.workos.com/sso/jwks/${clientId}`,
    },
    {
      type: "customJwt",
      issuer: `https://api.workos.com/user_management/${clientId}`,
      algorithm: "RS256",
      jwks: `https://api.workos.com/sso/jwks/${clientId}`,
    },
  ],
} satisfies AuthConfig; ```

[meager dew]

Hi @next ruin. I'm kapa.ai, your friendly support bot. I will try to answer your question by searching through the knowledge base. :wave:

---

Yes, your understanding is correct: Convex supports multiple auth providers in a single auth.config.ts, and it will pick the first provider whose iss/aud (or issuer/applicationID for customJwt) matches the token. [Custom OIDC; AuthProvider type]

From the docs and Discord:

• The Custom OIDC docs explicitly say: “If multiple providers are provided, the first one fulfilling the above criteria will be used.”[Custom OIDC]

• The WorkOS AuthKit guide configures two customJwt providers at once (for old vs new WorkOS issuer formats):[AuthKit config; React guide]

  const clientId = process.env.WORKOS_CLIENT_ID;
  
  export default {
    providers: [
      {
        type: "customJwt",
        issuer: `<https://api.workos.com/`,>
        algorithm: "RS256",
        applicationID: clientId,
        jwks: `<https://api.workos.com/sso/jwks/${clientId}`,>
      },
      {
        type: "customJwt",
        issuer: `<https://api.workos.com/user_management/${clientId}`,>
        algorithm: "RS256",
        jwks: `<https://api.workos.com/sso/jwks/${clientId}`,>
      },
    ],
  };
  

• In Discord, staff also explain why those two WorkOS providers coexist (old vs new issuer).[WorkOS thread]

So mixing Clerk OIDC plus WorkOS customJwt in one providers array, like in your example, is valid as long as each token’s iss/aud (or issuer/applicationID) matches exactly one of the configured providers.

Note: you can ask me a follow up question by @ mentioning me again :speech_balloon:

@next ruin Kapa.ai is still learning and improving, please let me know how I did by reacting below.

[next ruin]

@meager dew is there any discord examples of people using multiple providers for one mono repo or project

[meager dew]

Let me check the knowledge base for you again. One moment! :books:

---

Yes — there are Discord examples of people using multiple auth providers / apps against a single Convex backend in a monorepo-style setup, though they’re often described in terms of “multiple apps” or “web + mobile” rather than explicitly as “multiple providers”.

Relevant examples:

• One community member runs a turborepo monorepo with a web app, mobile app, and a shared Convex backend package; they mention using WorkOS in actions so it’s shared across both apps, and recommend doing the same for a setup with “two web apps” (admin + main site) against the same Convex backend.[Discord WorkOS thread]

• Another member talks about keeping WorkOS-related code “as separate as you can from your regular convex functions” and sharing it via a backend package, again implying multiple frontends over one Convex deployment.[Discord WorkOS thread]

• There are also multiple examples where more than one WorkOS provider is configured in auth.config.ts for a single Convex project (e.g., two customJwt providers for different WorkOS issuers), which demonstrates that Convex is happy to accept multiple auth providers in one deployment.[AuthKit React guide]

However, I don’t see a Discord snippet that explicitly shows “Clerk + WorkOS + X” all in one auth.config.ts in a monorepo; the sources show:

• multi-app monorepo sharing one Convex backend, and
• single Convex deployment with multiple WorkOS providers.

So your combined-provider config is consistent with how others are using Convex, but an exact “Clerk + WorkOS in one auth.config.ts” example isn’t shown in these threads.

Note: you can ask me a follow up question by @ mentioning me again :speech_balloon: