WorkOS/Convex `Authenticated` component not working

[royal belfry]

I have followed the two tutorials https://docs.convex.dev/auth/authkit/ and https://www.convex.dev/components/workos-authkit to get WorkOS and Convex working together. Sign in/Sign out works, and I confirmed Convex is getting the new user object in the WorkOS Authkit data for the component.

However, the page loads and shows the content in the <Unauthenticated> component rather than the <Authenticated> component, despite having a valid signed in user. Why is this?

[fluid flame]

Thanks for posting in #1088161997662724167.
Reminder: If you have a Convex Pro account, use the Convex Dashboard to file support tickets.

    - Provide context: What are you trying to achieve, what is the end-user interaction, what are you seeing? (full error message, command output, etc.)
    - Use [search.convex.dev](https://search.convex.dev) to search Docs, Stack, and Discord all at once.
    - Additionally, you can post your questions in the Convex Community's #1228095053885476985 channel to receive a response from AI.
    - Avoid tagging staff unless specifically instructed.

    Thank you!

[granite thorn]

I've been working on this today, and I've experienced the same problem, are using tanstack start by any chance?

[royal belfry]

It looks like the debugging section says...

Missing aud claim: WorkOS JWTs may not include the aud (audience) claim by default, which Convex requires for token validation. Check your WorkOS Dashboard JWT configuration to ensure the audience claim is properly set to your Client ID

However, the tutorial does not seem to discuss using the aud claim. Here is what the tutorial says should go in auth.config.ts for the JWT.

const clientId = process.env.WORKOS_CLIENT_ID;

export default {
  providers: [
    {
      type: "customJwt",
      issuer: `https://api.workos.com/`,
      algorithm: "RS256",
      applicationID: clientId,
      jwks: `https://api.workos.com/sso/jwks/${clientId}`,
    },
    {
      type: "customJwt",
      issuer: `https://api.workos.com/user_management/${clientId}`,
      algorithm: "RS256",
      jwks: `https://api.workos.com/sso/jwks/${clientId}`,
    },
  ],
};

Can you help me understand how to set up the aud claim for WorkOS and Convex?

[royal belfry]

I tried tanstack start a few days ago and couldn't get it working. This is my 2nd attempt, this time with just React and vite.

It seems like I was hitting different problems on my tanstack start version, though.

[granite thorn]

haven't tried other frameworks, but on while following the template I was getting something regarding "cookie" package not having parse in my browser, I didn't use the component though!

[royal belfry]

Yeah, I feel like I remember an error about a cookie, too. I also feel I saw something about a cookie password in...maybe the WorkOS docs? I don't know what that is, though. I will try to find it.

https://workos.com/docs/authkit/react/nodejs/3-handle-the-user-session/create-a-session-password

But I don't think this is in the Convex docs, and...I guess I just skipped over this section of the WorkOS Quick Start? I am not sure.

Also, just realized I leaked my key. Going to switch them. Done. 😬

[granite thorn]

This is my error

[royal belfry]

Is there anywhere in the code trying to access something called 'parse'?

[granite thorn]

https://github.com/workos/workos-node/issues/1352 mine is deff mentioned here

no, it's coming from iron-session that is used inside the workos enviroment it looks like

sorry for hijacking your thread 😅

[royal belfry]

I literally laughed out loud. No worries 😁

I'm just here to learn, make friends, and build cool stuff. So hijacking the thread is perfectly fine.

It doesn't seem like this is related. https://github.com/get-convex/convex-backend/issues/259

[granite thorn]

It actually does.. I guess we just have to wait

[royal belfry]

I wasn't thinking it was related to mine because my <Authenticated> continues to give false even after a refresh.

You are thinking it is the root of your problem, though? If you increase the token lifetime like they suggest, does that help with your problem?

[granite thorn]

yeah he mentions it stays false

[granite thorn]

letme try

[royal belfry]

Any luck?

I have been able to confirm that issue seems to be the same as my issue. I'm going to update the issue and reference thread. I think it might be helpful to see it may not be a framework related issue.

[royal belfry]

Any luck? I commented on the issue but have not heard back yet.

[granite thorn]

sorry got cought up in more important things, haven't had the chance to give it a try

[worn relic]

Looking into this

[worn relic]

It sounds like you never get to an authenticated state, as opposed to the linked issue where everything works until the token expires, and then an unauthenticated state occurs. Which should just be a setup issue.

Recommend starting a fresh app with npm create convex@latest and adding workos through the prompts. That will get you a basic working state that you can compare for troubleshooting your existing app.

[royal belfry]

No worries. I completely get it. 😁

[royal belfry]

Sounds good. Working on this now.

[royal belfry]

Creating a fresh project worked. Thank you erquhart! Hope you both have a great rest of the day.