Authentication
All Admin API requests require authentication via an admin key passed in theAuthorization header:
Admin key types
Used for CI/CD deployments. Can be scoped to production or preview deployments.Generate deploy keys in the Convex dashboard under Settings > Deploy Keys.
Full administrative access to a deployment.
- Read-write keys - Full access to all operations
- Read-only keys - Limited to read operations
Admin key validation
The backend validates admin keys through the application authentication system:Write access validation
For operations that modify data, use write access validation:Error codes
BadDeployKey
Returned when the provided admin key is invalid or doesn’t match the deployment:ReadOnlyAdminKey
Returned when attempting a write operation with a read-only admin key:Making API requests
The Admin API is accessed via HTTP endpoints on your deployment URL.Base URL
- Cloud deployments:
https://<deployment-name>.convex.cloud - Self-hosted: Your configured
--convex-origin
Example: List tables
Example: Query data
System functions
The Admin API exposes several built-in system functions:_system/cli/tables
List all tables in the deployment. Arguments:{}
Returns: Array of table objects with name field.
_system/cli/tableData
Query documents from a table. Arguments:table(string) - Table nameorder(string) - Sort order:"asc"or"desc"
_system/cli/environmentVariables
List environment variables. Arguments:{}
Returns: Object mapping variable names to values.
Using the Admin API from Node.js
You can use the Convex client library to make authenticated admin requests:Deployment management API
The Convex platform provides additional APIs for deployment management:Create preview deployment
Push API
The CLI uses a push API to deploy code:- Start push - Initiate a deployment
- Upload modules - Send function code
- Finish push - Complete the deployment
convex deploy and convex dev.
Rate limits
Admin API requests are subject to rate limits:- Cloud deployments: Shared limits per deployment
- Self-hosted: No built-in limits (configure at proxy level)
Security best practices
- Rotate keys regularly - Generate new admin keys periodically
- Use deploy keys in CI/CD - Don’t use full admin keys in automated systems
- Scope keys appropriately - Use read-only keys when write access isn’t needed
- Store keys securely - Use secrets managers, never commit to source control
- Monitor usage - Track admin key usage in your deployment logs
- Revoke compromised keys - Immediately revoke and regenerate if a key is exposed
Identity types
The Admin API authenticates requests as different identity types:InstanceAdmin- Full admin access from admin keyActingUser- Admin acting on behalf of a userSystem- Internal system operationsUser- End-user authenticated request (not admin)
Error handling
Admin API errors include:- 400 Bad Request - Invalid parameters
- 401 Unauthorized - Missing or invalid admin key
- 403 Forbidden - Admin key lacks required permissions
- 404 Not Found - Resource doesn’t exist
- 500 Internal Server Error - Server error
code and message fields:
OpenAPI specification
The Convex CLI is generated from OpenAPI specifications:- Management API:
cli-management-openapi.json - Function Logs API:
function-logs-openapi.json