Stuck in permanent unauthenticated state after access token expiry (AuthKit, Next.js)
I'm using WorkOS AuthKit together with Convex in a Next.js App Router project, and I'm consistently hitting an auth edge case:
* After the WorkOS access token expires, the next Convex queries that call
* AuthKit refreshes the token (verified in
* The Convex backend starts accepting the new token — new successful queries appear in the Convex dashboard.
* But on the client,
This permanently locks the UI out until a full page reload.
Things I tried:
* Official
*
* Custom
All end up with the same result: once Convex sees an error during the token-refresh window, its client auth state machine seems unable to transition back to authenticated (I think, I could only go so far in reading the source).
This feels related to the previously known
https://github.com/get-convex/convex-backend/issues/242
Full reproducible issue:
https://github.com/get-convex/convex-backend/issues/259
* After the WorkOS access token expires, the next Convex queries that call
auth.getIdentity() throw.* AuthKit refreshes the token (verified in
useAccessToken()).* The Convex backend starts accepting the new token — new successful queries appear in the Convex dashboard.
* But on the client,
useConvexAuth() never recovers and stays:This permanently locks the UI out until a full page reload.
Things I tried:
* Official
ConvexProviderWithAuth example from the docs*
ConvexProviderWithAuthKit from @convex-dev/workos* Custom
useAuth integrations with stable refs and effectsAll end up with the same result: once Convex sees an error during the token-refresh window, its client auth state machine seems unable to transition back to authenticated (I think, I could only go so far in reading the source).
This feels related to the previously known
preloadQuery auth racehttps://github.com/get-convex/convex-backend/issues/242
Full reproducible issue:
https://github.com/get-convex/convex-backend/issues/259
GitHub
When using WorkOS AuthKit with Convex in a Next.js App Router project, if a query requiring authentication is preloaded on the server (preloadQuery(..., { token })) and then consumed via usePreload...
GitHub
Summary When using WorkOS AuthKit with Convex in a Next.js App Router project, the Convex React client sometimes enters a permanent unauthenticated state after the access token expires. Even though...
