Authentication

Choose the Better Convex Nuxt auth API for state, operations, users, routes, and backend policy.

Authentication is optional. When enabled, Better Auth owns the session and Better Convex Nuxt coordinates the identity used by Convex.

Choose the layer

Need	API
Current auth status and session user	`useConvexAuth()`
Sign in, sign up, sign out, plugins	`useConvexAuth().client`
Application profile or projection	`useConvexQuery(query, args)`
Auth-state rendering	Native Vue conditionals
Navigation redirect	`definePageMeta({ convexAuth: true })`
Query identity policy	`auth: 'required' \| 'optional' \| 'none'`
Product access enforcement	Application-owned Convex functions
Additional Better Auth client plugins	`defineConvexAuthClient()`

Enable or disable auth

Auth is enabled only by an options object with one exact public origin:

convex: {
  auth: {
    origin: process.env.SITE_URL ?? 'http://localhost:3000'
  }
}

Omit auth for a direct Convex-only application:

convex: {
}

A no-auth build does not register Better Auth runtime plugins, proxy handlers, route middleware, auth auto-imports, or auth types. auth: false is reserved for a Nuxt configuration layer that must erase an inherited auth object.

Start here

New setup: Better Auth setup
Rendering state: Auth state and user
Operations: Sign in and sign out
Navigation: Route protection
Security: Backend authorization
Plugins: Better Auth plugins
Delegated agents: Delegated OAuth and MCP