feat: Migrate authentication from Clerk to WorkOS AuthKit

AGENTS.md

@@ -39,7 +39,7 @@ e2b template build --name your-template-name --cmd "/compile_page.sh"
 ### Tech Stack
 - **Frontend**: Next.js 15 (App Router), React 19, TypeScript, Tailwind CSS v4, Shadcn/ui
 - **Backend**: Convex (real-time database), tRPC (type-safe APIs)
-- **Auth**: Clerk with JWT authentication
+- **Auth**: WorkOS AuthKit with JWT authentication
 - **AI**: Vercel AI Gateway (Claude via Anthropic), Inngest Agent Kit
 - **Code Execution**: E2B Code Interpreter (isolated sandboxes)
 - **Background Jobs**: Inngest
@@ -123,9 +123,10 @@ Required for development:
 - `AI_GATEWAY_API_KEY`: Vercel AI Gateway key
 - `AI_GATEWAY_BASE_URL`: https://ai-gateway.vercel.sh/v1/
 - `E2B_API_KEY`: E2B sandbox API key
-- `NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY`: Clerk publishable key
-- `CLERK_SECRET_KEY`: Clerk secret key
-- `CLERK_JWT_ISSUER_DOMAIN`: Clerk JWT issuer domain (from dashboard)
+- `WORKOS_API_KEY`: WorkOS API key (from dashboard)
+- `WORKOS_CLIENT_ID`: WorkOS client ID (from dashboard)
+- `WORKOS_REDIRECT_URI`: Auth callback URL (e.g., http://localhost:3000/callback)
+- `WORKOS_WEBHOOK_SECRET`: WorkOS webhook secret (from dashboard)
 - `INNGEST_EVENT_KEY`: Inngest event key
 - `INNGEST_SIGNING_KEY`: Inngest signing key
 

CLAUDE.md

@@ -10,7 +10,7 @@ ZapDev is an AI-powered development platform that enables users to create web ap
 
 **Frontend**: Next.js 15 (Turbopack), React 19, TypeScript 5.9, Tailwind CSS v4, Shadcn/ui, React Query
 **Backend**: Convex (real-time database), tRPC (type-safe APIs)
-**Authentication**: Clerk (user auth & JWT)
+**Authentication**: WorkOS AuthKit (user auth & JWT)
 **AI & Execution**: Vercel AI Gateway, Inngest 3.44 (job orchestration), E2B Code Interpreter (sandboxes)
 **Monitoring**: Sentry, OpenTelemetry
 
@@ -176,6 +176,8 @@ Subscriptions enable real-time UI updates when data changes.
 
 **Query Client**: React Query configured in `src/trpc/query-client.ts` for caching, refetching, and optimistic updates.
 
+**Authentication Flow**: WorkOS AuthKit provides hosted authentication UI with OAuth callback handling. Users are redirected to WorkOS for sign-in/sign-up, then returned to the callback route with session tokens.
+
 ## Configuration
 
 ### Environment Variables
@@ -192,10 +194,12 @@ CONVEX_DEPLOYMENT
 # Code Execution
 E2B_API_KEY
 
-# Authentication (Clerk)
-NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY
-CLERK_SECRET_KEY
-CLERK_JWT_ISSUER_DOMAIN  # From Clerk Dashboard → JWT Templates
+# Authentication (WorkOS)
+WORKOS_API_KEY                    # From WorkOS Dashboard → API Keys
+WORKOS_CLIENT_ID                  # From WorkOS Dashboard → Configuration
+WORKOS_REDIRECT_URI               # Auth callback URL (e.g., http://localhost:3000/callback)
+WORKOS_WEBHOOK_SECRET             # From WorkOS Dashboard → Webhooks
+WORKOS_API_URL                    # WorkOS API endpoint (https://api.workos.com)
 
 # File Upload (UploadThing)
 UPLOADTHING_TOKEN  # Get from https://uploadthing.com/dashboard

README.md

@@ -11,7 +11,7 @@ AI-powered development platform that lets you create web applications by chattin
 - 💬 Conversational project development with message history
 - 🎯 Smart usage tracking and rate limiting
 - 💳 Subscription management with pro features
-- 🔐 Authentication with Clerk
+- 🔐 Authentication with WorkOS AuthKit
 - ⚙️ Background job processing with Inngest
 - 🗃️ Project management and persistence
 
@@ -23,11 +23,11 @@ AI-powered development platform that lets you create web applications by chattin
 - Tailwind CSS v4
 - Shadcn/ui
 - tRPC
-- Prisma ORM
-- PostgreSQL
+- Convex (real-time database)
+- tRPC (type-safe APIs)
 - Vercel AI Gateway (supports OpenAI, Anthropic, Grok, and more)
 - E2B Code Interpreter
-- Clerk Authentication
+- WorkOS AuthKit
 - Inngest
 - Prisma
 - Radix UI
@@ -142,13 +142,12 @@ AI_GATEWAY_BASE_URL="https://ai-gateway.vercel.sh/v1/"
 # E2B
 E2B_API_KEY=""
 
-# Clerk
-NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=""
-CLERK_SECRET_KEY=""
-NEXT_PUBLIC_CLERK_SIGN_IN_URL="/sign-in"
-NEXT_PUBLIC_CLERK_SIGN_UP_URL="/sign-up"
-NEXT_PUBLIC_CLERK_SIGN_IN_FALLBACK_REDIRECT_URL="/"
-NEXT_PUBLIC_CLERK_SIGN_UP_FALLBACK_REDIRECT_URL="/"
+# WorkOS Authentication
+WORKOS_API_KEY=""                    # From WorkOS Dashboard → API Keys
+WORKOS_CLIENT_ID=""                  # From WorkOS Dashboard → Configuration
+WORKOS_REDIRECT_URI="http://localhost:3000/callback"  # Auth callback URL
+WORKOS_WEBHOOK_SECRET=""             # From WorkOS Dashboard → Webhooks
+WORKOS_API_URL="https://api.workos.com"
 
 # Inngest (for background job processing)
 INNGEST_EVENT_KEY=""

convex/auth.config.ts

@@ -1,8 +1,25 @@
+const workosApiUrl = process.env.WORKOS_API_URL || "https://api.workos.com";
+const workosClientId = process.env.WORKOS_CLIENT_ID;
+
+if (!workosClientId) {
+  throw new Error("WORKOS_CLIENT_ID is not set in the environment");
+}
+
 export default {
   providers: [
     {
-      domain: process.env.CLERK_FRONTEND_API_URL,
-      applicationID: "convex",
+      type: "customJwt",
+      issuer: `${workosApiUrl}/sso`,
+      jwks: `${workosApiUrl}/sso/jwks`,
+      algorithm: "RS256",
+      applicationID: workosClientId,
+    },
+    {
+      type: "customJwt",
+      issuer: `${workosApiUrl}/user_management`,
+      jwks: `${workosApiUrl}/user_management/jwks`,
+      algorithm: "RS256",
+      applicationID: workosClientId,
     },
   ],
 };