convex-backend-skill

Build a durable multi-step pipeline on Convex where each step runs in order and is retried independently on failure (transcribe→summarize→email, ETL, order fulfillment, any 'do A then B then C, retry each' job). Use @convex-dev/workflow — do NOT hand-roll a chain of scheduler calls or a custom jobs table. TRIGGER on multi-step / pipeline / 'retry each step' / long-running orchestration requests.

Add authentication to the current Convex + web app — passkeys by default (OAuth/password optional), wired end to end incl. the auth.config.ts that's the #1 auth footgun. TRIGGER when the user wants login / sign-in / accounts / passkeys / OAuth for an existing app.

Design and build reactive, type-safe, production-grade backends on Convex. Covers schema, queries/mutations/actions, indexes, auth, file storage, scheduling, real-time multiplayer, mobile backends, and LLM/agent workflows on Convex's one-platform stack.

Send THIS coding session's transcript (Claude Code or Codex) to the Convex quickstart backend (anteater) for an AI post-mortem that improves the whole system — the runbook, bootstrap script, and skills. Use after a quickstart run (success or failure), or whenever the user wants to "send feedback", "report how that went", or "help improve the quickstart".

LABS — the FULL Convex quickstart experience: scaffold a running Next.js + shadcn app from one sentence with passkey (WebAuthn) sign-in and a live in-app Chef feedback panel pre-baked, build the idea live narrating through the panel, then PUBLISH it to a public https://<app>.convex.app URL (with the user's confirmation before publishing). For a plain local-only scaffold, use the `quickstart` skill instead.

Scaffold a brand-new Convex app from a one-sentence idea and build it live in front of the user — a running Next.js + shadcn app backed by `convex dev` + `next dev` with error watchers already armed. Use this to go from idea → running app in under a minute (it runs locally), then iterate, narrating each step in chat.

Add an AI agent / chatbot / RAG backend on Convex with @convex-dev/agent (durable threads, messages, tools, vector search). TRIGGER when the user wants an AI assistant/chatbot/agent or 'chat with my docs' feature. Keeps the LLM key in Convex env.

Add Stripe billing/payments/subscriptions to a Convex app via @convex-dev/stripe — checkout action, auto-verified webhook, server-side subscription gating. TRIGGER when the user wants payments/billing/subscriptions/a paywall/Stripe.

Set up recurring scheduled jobs (crons) on Convex — digests, cleanups, polling, retries. TRIGGER when the user wants a recurring/scheduled task ('every day/hour', cron, periodic cleanup). Targets internal functions, idempotent handlers.

Set + wire deployment env vars / secrets (API keys) for a Convex app — stored in Convex env, read in actions, never hardcoded. TRIGGER when the user needs an API key/secret/env var ('add my OpenAI key', 'set an env var').

Safely migrate the schema + backfill data on a deployed Convex app with @convex-dev/migrations. TRIGGER when changing the schema on a live app, backfilling data, or after a schema-validation error from a change. SKIP a fresh local app.

Seed the Convex database with starter/fixture data or import an existing dataset (CSV/JSON). TRIGGER when the user wants sample/seed data or to import a dataset into Convex. Idempotent, schema-matching.

Generate tests for Convex functions with convex-test (queries/mutations/auth/scheduling, in-memory). TRIGGER when the user wants tests / a test suite for their Convex backend / 'how do I test this'.

Audit and harden a Convex app's authorization: identity-from-arg impersonation, missing per-document ownership checks, public queries leaking PII/financial data by a client-supplied id, and writes into a parent/container the caller doesn't own — the single largest real-defect cluster measured against generated Convex backends (44 of 214). Runs a deterministic scan for the 4 shapes, then applies the canonical requireIdentity/requireOwner pattern, then verifies with tsc. TRIGGER on 'secure my app', 'audit auth', 'add login', 'who can access this data', or an explicit 'audit my authz'. NOT always-on. SKIP when there is no convex/ directory.

Add a capability to the CURRENT Convex app — consults the served Convex capability catalog for always-current procedures (billing, crons, auth, agent, search, …); falls back to built-in hosting or @convex-dev component search. TRIGGER when the user runs /add, or asks to add hosting/publishing or any backend capability to an existing Convex app.

Proactively suggest the right Convex component when you notice the user hand-rolling something that already exists: setInterval polling (→ @convex-dev/crons), shared counter increments (→ @convex-dev/sharded-counter), .collect().length scans (→ @convex-dev/aggregate), email (→ resend component), rate limiting via DB counter (→ @convex-dev/rate-limiter), fs.write uploads (→ Convex Storage), Elasticsearch (→ built-in search), online presence (→ @convex-dev/presence), long-running multi-step actions (→ @convex-dev/workflow), Pinecone/vector DB (→ @convex-dev/rag), or collaborative editing (→ @convex-dev/prosemirror-sync). TRIGGER when you notice this pattern in code or intent — AFTER completing the user's request, not interrupting it. DO NOT trigger for generic non-Convex questions.

Wire a domain the user ALREADY OWNS (GoDaddy/Namecheap/Cloudflare/…) to their Convex app: exact DNS records, custom-domain attachment, auth-origin rebind. TRIGGER when the user owns a domain and wants it pointing at their app ('point my domain at this', 'use my own domain', 'set up example.com'). Never asks for registrar credentials.