# 05 · Identity

https://exo.now/docs/stack/identity

> Exo Key on Convex Auth v2 — Exo is the only OAuth client and identity provider; Apps are relying parties.



<StackFacts dimension="05 · Identity" platforms="[&#x22;convex-auth&#x22;]" via="Exo Key" status="Exo Key live on staging for registered Apps; Clerk fully removed from EXO (ADR 0012)." />

## What it is [#what-it-is]

One sign-in for every property, with explicit App and Page scopes instead of a separate account
per property. Exo's Convex deployment mounts Convex Auth v2 (core plus Google and GitHub OAuth;
Apple when added) and holds the only provider registrations. It issues **app-scoped** RS256 access
tokens that Apps verify ([ADR 0004](../../../docs/adr/0004-exo-id-central-identity-provider.md)).

The full contract is on the [Exo Key](../platform/exo-key.mdx) service page.

## Platform [#platform]

**Convex Auth v2**, which is open source and native to the Convex database
([roadmap: convex-auth](../../../roadmap/items/convex-auth.md)). It runs as a pinned alpha
(`@convex-dev/auth` `2.0.0-alpha.2` in `package.json`). Per the Convex team, v2 is stable enough
to deploy now and reaches GA by Q4
([ADR 0003](../../../docs/adr/0003-convex-auth-v2-identity-plane.md)).

## Boundary and replaceability [#boundary-and-replaceability]

* **Apps never touch providers.** Apps don't mount auth components, don't hold `AUTH_*` or
  provider secrets, and never register with Google, GitHub, or Apple. Onboarding an App is a
  reviewed code change to `convex/lib/exoIdApps.ts`.
* **Authentication and authorization are separate.** Exo proves identity (`sub`, `email`, `name`).
  Authorization (roles, tenant grants) stays with the App in v1.
* **Upgrade containment.** Convex Auth upgrades are contained to `convex/auth.ts`,
  `convex/auth.config.ts`, `convex/convex.config.ts`, and the client provider.
* **Portability.** A person has one Exo user id across Apps, and Apps key their records on it.
  Identity exports omit credentials.
* **Consequence.** Exo's Convex deployment is a hard dependency for sign-in across the portfolio.
  Its availability and key rotation are platform responsibilities.

## Cost notes [#cost-notes]

* The move off Clerk was partly economic: Clerk "charges per MAU and makes a proprietary vendor the
  default login surface" (ADR 0003). Clerk's actual spend: **TBD**. EXO no longer uses Clerk; the
  account and subscription are the owner's to cancel.
* Convex Auth has no license fee. Its marginal cost is Convex function and storage usage:
  **TBD**.

## Status [#status]

* **Live on staging:** authorize page `https://staging.exo.now/id/authorize`, and token, revoke,
  JWKS, and discovery endpoints on `frugal-eel-930.convex.site/exo-id`.
* **Registered Apps:** `observatory`, `construct`, `rampart`, `dropship`, and `universe`, plus
  `exo-staging` (EXO's own browser session) and the headless `exo` API audience
  ([Exo Key guide](../../../docs/exo-id.md)).
* **Done:** Clerk is fully removed from EXO
  ([ADR 0012](../../../docs/adr/0012-clerk-removed-convex-auth-everywhere.md)). EXO's own `/sign-in`
  and the `staging.exo.now/{app}` gateway sign in through Exo Key as the `exo-staging` relying
  party, and staging access needs an exact non-production grant (`EXO_STAGING_GRANTS`).
* **In progress:** Apps outside EXO that still carry their own Clerk code move to Exo Key in their
  repositories ([convex-auth](../../../roadmap/items/convex-auth.md)).
* **Pending:** a version-bump pass before Convex Auth v2 GA (Q4).