[kvz]

Why

The quickstart currently recommends public signing/metadata functions that do not authorize their
callers. Meanwhile, constructing the server-side client requires signing credentials even when an
app only reads local Storage receipts or runs Convex module analysis.

Changes

• Resolve client credentials when the operation needs them; keep the writable public config API.
• Require both key and secret for signing/refresh, but only the secret for verified webhooks.
• Recommend app-owned functions and internal webhook ingestion, linking the existing wedding app's
  real access checks and upload flow instead of a partial Uppy snippet.
• Deprecate the unauthenticated factory and .api() without changing their public exports. Document
  migration explicitly: upgrading does not retrofit authorization into existing consumers.

Validation

• Credential regression tests failed before the fix and pass afterward.
• yarn check: 305 tests passed, no type errors; existing unrelated lint/Node warnings retained.
• Focused local API/handler regressions include signed, tampered and missing-signature HTTP webhooks,
  anonymous and cross-owner denials, revoked sessions, exact media authorization, and no-store delivery.
• Council review: no issues found. Independent Opus defensive review: PASS; incorporated its
  non-blocking source-link corrections and stronger signature-boundary tests.
• Package build and built-client smoke test passed without Assembly credentials for local reads.
• Final GitHub CI is green, including Node 24/26, component codegen, local browser tests and cloud
  preview QA against the branch's assigned backend.

The first preview QA run correctly refused the unconfigured branch backend. Only this branch's
non-secret NEXT_PUBLIC_CONVEX_URL was bound to its assigned Convex preview; production is unchanged.

Local evidence uses toy fixtures in convex-test and Request handlers, not production or a live
browser login. No production configuration, credentials, schema, or demo dependency changed.
Includes a patch changeset; the wedding app stays on the published package until a separate release.

_{🤖 Claimed by kvz on studio1/convex since 2026-10-18 · resume: codex resume 019fa2ee-f994-79d0-9d50-071bf2cb7ad6}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
convex	Ready	Preview	Oct 18, 2026 8:54am UTC