Convex OAuth-minted preview deploy keys 401: server-side fix shipped

TL;DR

If a Convex preview deploy key minted through an OAuth app 401s at claimpreviewdeployment, this was a known server-side validation gap that Convex fixed in July 2026: the OAuth token pass-through key is now accepted.

Steps

1. If a Convex preview deploy key minted through an OAuth app 401s at claimpreviewdeployment, this was a known server-side validation gap that Convex fixed in July 2026: the OAuth token pass-through key is now accepted. Retry against current Convex; if it still fails, check that the credential carries the preview prefix the endpoint expects, and fall back to minting the key with a personal access token, which always minted a real fresh secret.

Expected: The maintainer confirmed the pass-through behavior and shipped a server-side fix so claimpreviewdeployment accepts the OAuth-backed credential; the reporter tested and confirmed it works.

When to use

You are seeing this: Minting the same key with a personal access token worked fine, which made the OAuth path look broken. Use this skill when you run into "Convex OAuth-minted preview deploy keys 401: server-side fix shipped".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Source: GitHub issue get-convex/convex-js#172 (closed, 5 comments): when an OAuth application token was used to mint a preview deploy key via the Management API, the endpoint did not mint a fresh key, it returned the OAuth access token itself with only the prefix swapped, and claimpreviewdeployment then rejected it with 401 Invalid Convex preview deploy key. Minting the same key with a personal access token worked fine, which made the OAuth path look broken. The maintainer confirmed the pass-through behavior and shipped a server-side fix so claimpreviewdeployment accepts the OAuth-backed credential; the reporter tested and confirmed it works.

Verified resolution: If a Convex preview deploy key minted through an OAuth app 401s at claimpreviewdeployment, this was a known server-side validation gap that Convex fixed in July 2026: the OAuth token pass-through key is now accepted. Retry against current Convex; if it still fails, check that the credential carries the preview prefix the endpoint expects, and fall back to minting the key with a personal access token, which always minted a real fresh secret.

Source URL: https://github.com/get-convex/convex-js/issues/172