I think I have the setup right now. My mistake was only including the shared WorkOS env variable to Vercel. I didn't make them the default in convex. This caused convex to create a new Convex managed WorkOS environment for every preview run. Login worked because the client had the shared env vars, but the JWT token validation was breaking because Convex was not using the shared env vars for WorkOS.
If it's not being worked on we really need a way to clean these up ourselves. Currntly Convex is also doing it wrong IMO because I can delete a Convex preview environment with an associated WorkOS environment and the associated WorkOS environment doesn't get deleted with it.
Convex does have a way to delete the provisioned WorkOS environment, but that's only accessible from the associated Convex environment and once you delete that, you're stuck with a dangling WorkOS environment.
Attempting to delete these via the WorkOS cli throws a 404 and my understanding is that occurs because it won't allow deletion of a managed instance. A Convex managed instance in this case.
Putting this here because I don't think there's a proper Github source or similar for this.
Possible Fix
1. Update the Convex UI to view and delete any Convex managed WorkOS instance 2. Optional: Delete the related WorkOS environment when the associated Convex deployment is deleted This might happen with the deletion schedule but I had so many of them I was was deleting them manually via the Convex UI. 3. Optional: Work with WorkOS to support a CLI to delete managed WorkOS environments