Wire the keys,
then issue keys.

Create an app at the Clerk dashboard. Copy the publishable and secret keys into .env.local. Enable email sign-up, then create a JWT template named convex with these claims.

{
  "aud": "convex",
  "email": "{{user.primary_email_address}}",
  "email_verified": "{{user.email_verified}}",
  "name": "{{user.full_name}}",
  "picture": "{{user.image_url}}"
}

Set the issuer domain, webhook secret, both peppers, and the proxy secret on the Convex deployment. The issuer domain is the Clerk Frontend API URL, for example https://your-app.clerk.accounts.dev. Generate fresh peppers with the commands below, and reuse the same server-only proxy secret in the Next.js environment.

npx convex env set CLERK_JWT_ISSUER_DOMAIN https://your-app.clerk.accounts.dev
npx convex env set CLERK_WEBHOOK_SECRET whsec_...
npx convex env set RATE_LIMIT_PEPPER "$(openssl rand -hex 32)"
npx convex env set HARDWARE_PEPPER "$(openssl rand -hex 32)"
npx convex env set LICENSE_PROXY_SECRET "<same 64-char secret>"

In Clerk → Webhooks, add https://accomplished-curlew-99.convex.site/clerk-webhook and subscribe to user.created, user.updated, and user.deleted. Put the endpoint signing secret in the Convex environment as CLERK_WEBHOOK_SECRET. It does not belong in Next.js. Placeholder secrets are rejected by the route.

# Clerk (Next.js server + browser)
NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=pk_test_...
CLERK_SECRET_KEY=sk_test_...

# Convex (npx convex dev writes these)
NEXT_PUBLIC_CONVEX_URL=https://your-deployment.convex.cloud
NEXT_PUBLIC_CONVEX_SITE_URL=https://your-deployment.convex.site

# App
NEXT_PUBLIC_APP_URL=https://auth.arnislive.com

# Server-only, shared with Convex
LICENSE_PROXY_SECRET=<same 64-char secret>

Restart next dev. This page will flip to configured, and onboarding will provision the account from the verified Clerk identity. The secret key is checked by the server on the first protected request.