support custom auth api domain

README.md

@@ -88,6 +88,23 @@ authKit.registerRoutes(http);
 export default http;
 ```
 
+## Custom domain
+
+If you've configured a [custom WorkOS authentication API domain](https://workos.com/docs/custom-domains/auth-api), set the `apiHostname` option (or `WORKOS_API_HOSTNAME` env var) when constructing the AuthKit client. This routes the WorkOS SDK through your domain and updates the JWT issuer and JWKS URLs to match.
+
+```ts
+// convex/auth.ts
+export const authKit = new AuthKit<DataModel>(components.workOSAuthKit, {
+  apiHostname: "auth.example.com",
+});
+```
+
+Or set it on the deployment:
+
+```sh
+npx convex env set WORKOS_API_HOSTNAME=auth.example.com
+```
+
 ## Usage
 
 User create/update/delete in WorkOS will be automatically synced by the

eslint.config.js

@@ -10,8 +10,6 @@ export default [
     ignores: [
       "dist/**",
       "example/dist/**",
-      "*.config.{js,mjs,cjs,ts,tsx}",
-      "example/**/*.config.{js,mjs,cjs,ts,tsx}",
       "**/_generated/",
       "initTemplate.mjs",
     ],

src/client/index.ts

@@ -6,7 +6,6 @@ import {
   type HttpRouter,
   createFunctionHandle,
   httpActionGeneric,
-  internalActionGeneric,
   internalMutationGeneric,
 } from "convex/server";
 import type { RunQueryCtx } from "./types.js";
@@ -31,6 +30,7 @@ type Options = {
   authFunctions?: AuthFunctions;
   clientId?: string;
   apiKey?: string;
+  apiHostname?: string;
   webhookSecret?: string;
   webhookPath?: string;
   additionalEventTypes?: WorkOSEvent["event"][];
@@ -95,27 +95,33 @@ export class AuthKit<DataModel extends GenericDataModel> {
       apiKey,
       webhookSecret,
       actionSecret: options?.actionSecret ?? process.env.WORKOS_ACTION_SECRET,
+      apiHostname: options?.apiHostname ?? process.env.WORKOS_API_HOSTNAME,
       webhookPath: options?.webhookPath ?? "/workos/webhook",
     };
-    this.workos = new WorkOS(this.config.apiKey);
+    this.workos = new WorkOS(this.config.apiKey, {
+      clientId: this.config.clientId,
+      apiHostname: this.config.apiHostname,
+    });
   }
 
-  getAuthConfigProviders = () =>
-    [
+  getAuthConfigProviders = () => {
+    const apiBaseUrl = `https://${this.config.apiHostname ?? "api.workos.com"}`;
+    return [
       {
         type: "customJwt",
-        issuer: `https://api.workos.com/`,
+        issuer: `${apiBaseUrl}/`,
         algorithm: "RS256",
-        jwks: `https://api.workos.com/sso/jwks/${this.config.clientId}`,
+        jwks: `${apiBaseUrl}/sso/jwks/${this.config.clientId}`,
         applicationID: this.config.clientId,
       },
       {
         type: "customJwt",
-        issuer: `https://api.workos.com/user_management/${this.config.clientId}`,
+        issuer: `${apiBaseUrl}/user_management/${this.config.clientId}`,
         algorithm: "RS256",
-        jwks: `https://api.workos.com/sso/jwks/${this.config.clientId}`,
+        jwks: `${apiBaseUrl}/sso/jwks/${this.config.clientId}`,
       },
     ] satisfies AuthConfig["providers"];
+  };
 
   async getAuthUser(ctx: RunQueryCtx) {
     const identity = await ctx.auth.getUserIdentity();