Read the authenticated caller's identity in a Convex function with ctx.auth.getUserIdentity, and configure production deploys and environment variables via the Convex CLI

Documented steps

1. Inside any query, mutation or action call const identity = await ctx.auth.getUserIdentity(); it is available via the auth property on QueryCtx/MutationCtx/ActionCtx.
2. Guard functions that require a signed-in user: if (identity === null) { throw new Error("Unauthenticated call"); }.
3. Every non-null UserIdentity includes tokenIdentifier (a unique combination of subject and issuer), subject and issuer; with Clerk or Auth0, standard OpenID fields such as email, emailVerified, givenName, familyName, nickname, pictureUrl and updatedAt are commonly present too.
4. Use tokenIdentifier (not email) as the stable user key, and store it on your own users table with an index such as .index("by_token", ["tokenIdentifier"]).
5. For HTTP actions the client must send the JWT explicitly, e.g. fetch(url, { headers: { Authorization: 'Bearer ' + jwtToken } }), for getUserIdentity() to resolve an identity.
6. Deploy to production with npx convex deploy from the project root; the CLI picks the target from CONVEX_DEPLOY_KEY (typical in CI) or falls back to the production deployment tied to CONVEX_DEPLOYMENT (typical locally).
7. npx convex deploy typechecks functions, regenerates convex/_generated, bundles functions and dependencies, and pushes functions, indexes and schema.
8. Optionally pass --cmd "npm run build" to run the frontend build as part of the deploy, with the deployment URL exposed as an env var (renameable with --cmd-url-env-var-name).
9. Set production environment variables with npx convex env set NAME value (add --prod to target production, or --from-file .env.convex to load several); verify with npx convex env list or npx convex env get NAME.
10. Remove a variable with npx convex env remove NAME; read them in functions via process.env.NAME, which is undefined when unset.
11. Official docs: https://docs.convex.dev/auth/functions-auth and https://docs.convex.dev/production/environment-variables