Which AI coding clients on this machine can reach my project's auth configuration?

checks the configured server with a real connection handshake and reports back one of three states — not installed, installed but unreachable, or working — instead of just confirming a config file exists

Can my customers' IT admins set up their own enterprise SSO without opening a ticket with us?

exposes a Security tab inside the organization profile where an admin configures SAML or OIDC directly, with domain ownership checked via a DNS record and the connection scoped to their organization only

Are new SAML sign-ins silently creating accounts I didn't approve?

a per-connection setting rejects sign-in attempts from users without a pre-provisioned account, and the same control is readable and toggleable through the dashboard or the API for auditing across connections

What is a given user actually experiencing in my app right now?

one-command impersonation lets a developer instantly assume that user's session to reproduce what they see, without needing their credentials

Can I test webhook-dependent flows before deploying anywhere public?

a local toolkit receives and inspects webhook events on a developer's own machine, removing the need for a public URL during development

Clerk release history — The Cyber Toolchain

Group webhooks, group reads, and pause for Directory Sync (2026-11-03) Nov 3, 2026 · issue 130

Clerk adds the ability to read a Directory Sync group and its members via the Backend API, and to pause a directory without removing user access.

New integrationClerk's Backend API now supports reading a group and its members via Directory Sync.
Pause a Directory Sync directory without removing any user access.

2 details in Everything

changelog Nov 1, 2026 · issue 127

Clerk adds a Backend API logs endpoint, passkeys as a second MFA factor, agent feedback collection via MCP, and two new bulk sign-up protections⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Enable passkeys as a second factor for an existing application created before July 8, 2026.

📍In the Clerk Dashboard, go to User & authentication and turn on Passkeys satisfy multi-factor authentication and Sign-in with passkey. Then go to the Updates page and opt in to the 'Passkeys as a second factor on the web' update if your instance does not already have it.

Query audit logs programmatically with the GET /v1/logs Backend API endpoint, filtering on the same event types available in the Dashboard; requests over the rate limit return too_many_requests.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Collect agent feedback through your MCP server by adding the submit_feedback tool from @clerk/mcp-tools, so agents can report friction — missing tools, unexpected errors, or blocked tasks — as they encounter it.
Allow passkeys to satisfy multi-factor authentication as a second factor: users who sign in with a password, social connection, or reset-password code can present a passkey instead of an SMS code or authenticator app, including during reverification; supportedSecondFactors can now include passkey in custom MFA flows.
Limit bulk account creation on the Business plan with two new Clerk Protect rules: Limit sign-ups per email domain caps sign-ups from one domain per hour, and Limit sign-ups from shared infrastructure caps bursts from the same infrastructure.
Clerk for Agent Auth, built on open OAuth standards and the Personal Agent Protocol, is now in private beta, enabling agents to discover your application and authenticate through Clerk.

Query audit logs programmatically with the GET /v1/logs Backend API endpoint, filtering on the same event types available in the Dashboard; requests over the rate limit return too_many_requests.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Collect agent feedback through your MCP server by adding the submit_feedback tool from @clerk/mcp-tools, so agents can report friction — missing tools, unexpected errors, or blocked tasks — as they encounter it.
Clerk for Agent Auth, built on open OAuth standards and the Personal Agent Protocol, is now in private beta, enabling agents to discover your application and authenticate through Clerk.

2 more in Everything

└──▷ BREAKING ON UPGRADE

!Test email addresses (+clerk_test subaddress) no longer receive any emails while Test mode is on — test suites that read sign-in links or invitation emails from a real inbox must switch those addresses to ones without +clerk_test.

Read Application Logs with the Backend API (2026-10-30) Oct 30, 2026 · issue 126

Clerk adds public access to the GET /v1/logs endpoint so application log events can be queried from code or AI agents⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Fetch recent application log events from Clerk to feed into an AI agent or custom monitoring pipeline.

$ curl -X GET 'https://api.clerk.com/v1/logs' \
  -H 'Authorization: Bearer <your_secret_key>'

Query application log events programmatically via the now-public GET /v1/logs Backend API endpoint, usable from custom code or an AI agent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 detail in Everything

Passkeys as a second factor (2026-10-29) Oct 29, 2026 · issue 125

Clerk adds passkeys as a second factor for multi-factor authentication⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Clerk now supports passkeys as a second factor, letting users verify with a passkey after signing in with another method.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 detail in Everything

2026-08-20 Oct 26, 2026 · issue 121

API surface changed: +3 endpoints, 18 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

API change

API surface changed: +3 endpoints, 18 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

+ GET /directories/{directory_id}/groups/{group_id}
+ GET /directories/{directory_id}/groups/{group_id}/members
+ POST /users/{user_id}/merge
~ DELETE /organizations/{organization_id}/logo: response schema changed
~ GET /directories: response schema changed
~ GET /directories/{directory_id}: response schema changed
~ GET /instance: response schema changed
~ GET /organizations: response schema changed
~ GET /organizations/{organization_id}: response schema changed
~ GET /scim_directories: response schema changed
~ GET /scim_directories/{scim_directory_id}: response schema changed
~ PATCH /directories/{directory_id}: request body changed; response schema changed
~ PATCH /organizations/{organization_id}: request body changed; response schema changed
~ PATCH /organizations/{organization_id}/metadata: response schema changed
~ PATCH /scim_directories/{scim_directory_id}: request body changed; response schema changed
~ POST /directories: response schema changed
~ POST /directories/{directory_id}/rotate_api_key: response schema changed
~ POST /organizations: response schema changed
~ POST /scim_directories: response schema changed
~ POST /scim_directories/{scim_directory_id}/rotate_api_key: response schema changed
~ PUT /organizations/{organization_id}/metadata: response schema changed

New endpoint GET /directories/{directory_id}/groups/{group_id}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
New endpoint GET /directories/{directory_id}/groups/{group_id}/members
New endpoint POST /users/{user_id}/merge

3 details in Everything

Agent feedback (2026-10-23) Oct 23, 2026 · issue 119

Clerk adds agent feedback collection via MCP server, reviewable in the Clerk dashboard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Merge two users into one (2026-10-23) Oct 23, 2026 · issue 119

Clerk adds a Backend API endpoint to merge a duplicate user into another and delete the duplicate.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

changelog Oct 22, 2026 · issue 116

Clerk MCP server gains account access, native Expo components split into a separate package, and Dashboard masks Secret keys after creation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Migrate an Expo app that uses native Clerk components to the new separate package so the main bundle no longer includes the iOS/Android SDKs.

$ npx expo install @clerk/expo-native-components

Splits Clerk's native Expo components (<AuthView />, <UserButton />, <UserProfileView />) into a dedicated @clerk/expo-native-components package, imported from @clerk/expo/native-components, so apps not using native components no longer bundle the iOS and Android SDKs — available in @clerk/expo 4.11.0.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Connects the Clerk MCP server to your Clerk account, enabling agents to create applications, configure authentication, manage users, and set up production instances via your MCP client's sign-in flow.
Updates the API keys page in the Clerk Dashboard to reveal a Secret key's full value only at creation time, showing only a partial value thereafter to reduce the risk of key leakage.

Splits Clerk's native Expo components (<AuthView />, <UserButton />, <UserProfileView />) into a dedicated @clerk/expo-native-components package, imported from @clerk/expo/native-components, so apps not using native components no longer bundle the iOS and Android SDKs — available in @clerk/expo 4.11.0.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

2 more in Everything

└──▷ BREAKING ON UPGRADE

!The @clerk/expo/native import path is deprecated and will be removed in the next major version; update imports to @clerk/expo/native-components after installing @clerk/expo-native-components.
!On Android, apps without @clerk/expo-native-components no longer migrate biometric credentials enrolled with earlier SDK versions — affected users must re-enroll. The new app binary must be shipped before any over-the-air update that includes this change, or native components will throw a runtime error.

docs update Oct 20, 2026 · issue 114

Clerk iOS/macOS setup now supports a Clerk CLI agent workflow with npx clerk@latest init, doctor, and whoami commands.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Initialize Clerk in an existing Xcode project with the prebuilt sign-in UI, wiring up the SDK, Native API, and app registration in one command.

$ npx -y clerk@latest init --app <application_id> --prebuilt-auth-ui --yes --json

After init, run the doctor to confirm project and Clerk settings are correctly configured for a specific target and configuration.

$ npx -y clerk@latest doctor --xcode-project MyApp.xcodeproj --xcode-target MyApp --xcode-configuration Debug --json

Install Clerk without the prebuilt UI (ClerkKit core only) when building a fully custom sign-in flow.

$ npx -y clerk@latest init --app <application_id> --apple-sdk core --yes --json

Adds npx -y clerk@latest init --app <application_id> --yes --json to scaffold Clerk into an Xcode project, downloading the SDK, configuring capabilities, enabling the Native API, and registering the native app on the development instance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds npx -y clerk@latest doctor --json to validate project and Clerk settings after setup, usable with --xcode-project, --xcode-target, and --xcode-configuration selectors.
Adds npx -y clerk@latest whoami and npx -y clerk@latest auth login for CLI authentication during agent-driven setup.
Adds npx -y clerk@latest apps list --json and npx -y clerk@latest apps create "<application_name>" --json to list or create Clerk applications from the CLI.
Adds --prebuilt-auth-ui and --sign-in-with-apple flags to clerk init to opt into Clerk's prebuilt sign-in UI or native Sign in with Apple independently.

+4 more show less

Adds --apple-sdk core flag to install ClerkKit alone (without ClerkKitUI) when the prebuilt UI is not wanted.
Adds --bundle-id and --app-id-prefix flags to clerk init for supplying Apple identifiers when the CLI cannot discover or match them automatically.
Requires adding an Associated Domains capability in Xcode with the entry webcredentials:<frontend_api_url> to support passkeys and credential AutoFill via a web-credentials relationship with the Clerk Frontend API domain.
Exposes handoff.completed, handoff.remaining, handoff.tasks, and handoff.xcode.developerDir fields in the clerk init JSON output to guide post-init Swift integration steps.

9 details in Everything

docs update Oct 20, 2026 · issue 114

Clerk CLI adds native iOS/macOS SwiftUI project setup, non-interactive agent mode, environment file management, and broader framework auto-detection.

New supported platformAdds iOS and macOS SwiftUI app support to the Clerk CLI, auto-detecting Xcode projects, installing the SDK, configuring native registration, and offering to enable native Sign in with Apple.
Adds non-interactive mode where the CLI applies setup without prompts and returns remaining Swift integration tasks for an agent to complete.
Adds environment variable management for projects that use environment files via the CLI.

3 details in Everything

announced Oct 15, 2026 · issue 113

Clerk's MCP server gains account management tools — list, create, and configure apps, instances, users, and domains via AI agent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ USE IT

Register the Clerk MCP server in your AI client so your agent can authenticate and manage Clerk resources.

text

https://mcp.clerk.com/mcp

Ask your agent to walk through production setup — it creates the instance, copies dev settings, and reports outstanding DNS and OAuth gaps.

📍Take this app to production on example.com and tell me what's left.

Preview a user creation in your development instance before committing, using the dry-run mode.

📍Create a test user in my development instance with the email ada@example.com — dry run first, show me what would change.

Adds https://mcp.clerk.com/mcp as a remote MCP server endpoint, enabling AI clients to authenticate with a Clerk account and manage apps, instances, users, and domains without leaving the agent session.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds account sign-in to the Clerk MCP server so agents can read and modify workspace apps and instances from the same authenticated session after a one-time consent approval.
Adds MCP tools to read and create Clerk applications and to read or change instance settings (with sensitive values redacted).
Adds MCP tools to list, filter, and create users within a Clerk instance.
Adds MCP tools to list an app's domains with their required DNS records and to trigger DNS, certificate, and email verification re-checks.

+3 more show less

Adds a production-deployment workflow via MCP that creates a production instance on a given domain, copies development settings, and reports required DNS records and OAuth credential gaps.
Enforces per-call scoped tokens expiring within 5 minutes — each MCP tool call receives only that tool's permissions, preventing cross-tool privilege escalation.
Supports a dry-run mode for instance setting changes and user creation so agents can preview changes before applying them.

8 details in Everything

Clerk MCP server (2026-10-15) Oct 15, 2026 · issue 110

Clerk launches a revamped MCP server for managing applications, users, and configuration directly from an AI agent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

docs update Oct 10, 2026 · issue 100

Clerk adds challenge-based blocking for sign-ups that appear automated or originate from VPNs, Tor, or proxies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

changelog Oct 5, 2026 · issue 095

Clerk adds self-serve Directory Sync in <OrganizationProfile /> and SSO bypass allowlists with the sign_in.sso_bypass.succeeded audit event for broken enterprise connections.

New integrationSelf-serve Directory Sync wizard inside <OrganizationProfile /> Security tab lets admins with org:sys_entconns:manage configure SCIM provisioning, review attribute mappings, and test provisioning without Clerk Dashboard access.
SSO bypass allowlist lets approved users sign in with a one-time email code when the IdP is unavailable; each successful bypass emits a sign_in.sso_bypass.succeeded audit event.
New org:sys_entconns_sso_bypass:manage system permission enables Organization admins to manage the SSO bypass allowlist from <OrganizationProfile />; the default Admin role includes this permission.
Dashboard 'Allow this organization to set up enterprise SSO and Directory Sync' toggle under Organization permissions controls availability of both self-serve features.

4 details in Everything

changelog Oct 4, 2026 · issue 094

Clerk adds self-serve Directory Sync inside <OrganizationProfile /> and SSO bypass allowlists for enterprise connections.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Enable self-serve Directory Sync for an organization so its admin can configure SCIM provisioning without Clerk Dashboard access.

📍In the Clerk Dashboard: select an Organization › open its Settings › under Organization permissions, turn on 'Allow this organization to set up enterprise SSO and Directory Sync'. The Directory Sync section then appears in the Security tab of <OrganizationProfile /> wherever it renders in your app.

Adds org:sys_entconns:manage permission-gated self-serve Directory Sync wizard inside the <OrganizationProfile /> Security tab, supporting Okta Workforce, Microsoft Entra ID, Google Workspace, and custom SAML/OIDC connections — admins get a generated SCIM endpoint URL and bearer token without needing Clerk Dashboard access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds sign_in.sso_bypass.succeeded audit event logged each time a user on an SSO bypass allowlist signs in via one-time email code instead of through the IdP.
Adds org:sys_entconns_sso_bypass:manage system permission, included in the default Admin role, allowing Organization members to manage their SSO bypass allowlist from <OrganizationProfile />.
Enables the Allow this organization to set up enterprise SSO and Directory Sync toggle under Organization permissions in the Clerk Dashboard to expose the self-serve Directory Sync section wherever <OrganizationProfile /> or <OrganizationSwitcher /> renders.
Adds SSO bypass, letting a per-connection allowlist of users sign in with a one-time email code when an enterprise SSO connection is broken or unavailable, surfacing a 'Can't use SSO?' link in <SignIn />.

+3 more show less

Supports pausing, resuming, or removing a self-serve Directory Sync connection from within <OrganizationProfile /> after initial setup.
Supports Google Workspace Directory Sync via Google Admin SDK by uploading a service account key and a Workspace admin email address inside the self-serve wizard.
Retains Dashboard-side controls for custom attribute mapping and role mapping (off by default) for self-serve directories alongside dashboard-managed directories.

Adds org:sys_entconns:manage permission-gated self-serve Directory Sync wizard inside the <OrganizationProfile /> Security tab, supporting Okta Workforce, Microsoft Entra ID, Google Workspace, and custom SAML/OIDC connections — admins get a generated SCIM endpoint URL and bearer token without needing Clerk Dashboard access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds sign_in.sso_bypass.succeeded audit event logged each time a user on an SSO bypass allowlist signs in via one-time email code instead of through the IdP.
Adds org:sys_entconns_sso_bypass:manage system permission, included in the default Admin role, allowing Organization members to manage their SSO bypass allowlist from <OrganizationProfile />.
Enables the Allow this organization to set up enterprise SSO and Directory Sync toggle under Organization permissions in the Clerk Dashboard to expose the self-serve Directory Sync section wherever <OrganizationProfile /> or <OrganizationSwitcher /> renders.
Adds SSO bypass, letting a per-connection allowlist of users sign in with a one-time email code when an enterprise SSO connection is broken or unavailable, surfacing a 'Can't use SSO?' link in <SignIn />.

+2 more show less

Supports pausing, resuming, or removing a self-serve Directory Sync connection from within <OrganizationProfile /> after initial setup.
Supports Google Workspace Directory Sync via Google Admin SDK by uploading a service account key and a Workspace admin email address inside the self-serve wizard.

1 more in Everything

2026-05-12 Oct 3, 2026 · issue 093

API surface changed: +4 endpoints, 11 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

API change

API surface changed: +4 endpoints, 11 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

+ DELETE /invitations/{invitation_id}
+ DELETE /sso_bypass_allowlist_users/{userID}
+ GET /sso_bypass_allowlist_users
+ POST /sso_bypass_allowlist_users
~ PATCH /domains/{domain_id}: response schema changed
~ PATCH /enterprise_connections/{enterprise_connection_id}: request body changed
~ PATCH /organizations/{organization_id}: request body changed
~ PATCH /saml_connections/{saml_connection_id}: request body changed
~ PATCH /users/{user_id}: request body changed
~ POST /domains: response schema changed
~ POST /enterprise_connections: request body changed
~ POST /instance/change_domain: response schema changed
~ POST /saml_connections: request body changed
~ POST /users: request body changed
~ PUT /beta_features/domain: response schema changed

New endpoint DELETE /invitations/{invitation_id}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
New endpoint DELETE /sso_bypass_allowlist_users/{userID}
New endpoint GET /sso_bypass_allowlist_users
New endpoint POST /sso_bypass_allowlist_users

4 details in Everything

docs update Sep 30, 2026 · issue 090

Clerk adds a beta Electron SDK (@clerk/electron) for native desktop app authentication with React and IPC bridge support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Allowlist your Electron dev-server origin on your Clerk instance so the renderer's Authorization + Origin headers are accepted by the Frontend API.

$ curl -X PATCH https://api.clerk.com/v1/instance \
  -H "Authorization: Bearer YOUR_SECRET_KEY" \
  -H "Content-type: application/json" \
  -d '{"allowed_origins": ["http://localhost:5173"]}'

Wire up Clerk's IPC handlers and token storage in the Electron main process before the app is ready, and guard bootstrap on the primary instance.

typescript

import { createClerkBridge } from '@clerk/electron'
import { storage } from '@clerk/electron/storage'

const clerk = createClerkBridge({ storage: storage() })

if (clerk.isPrimaryInstance) {
  app.on('ready', createWindow)
}

app.on('before-quit', () => { clerk.cleanup() })

Set the Clerk Publishable Key and Frontend API host for the Vite renderer so <ClerkProvider> can authenticate users.

.env

VITE_CLERK_PUBLISHABLE_KEY=pk_test_...
VITE_CLERK_FRONTEND_API_HOST=clerk.<your-instance>.lcl.dev

Adds @clerk/electron SDK (beta) for integrating Clerk authentication into Electron 28+ apps, requiring Node.js 20.9+ and contextIsolation enabled.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds createClerkBridge() from @clerk/electron to register IPC handlers and token storage in the main process; exposes isPrimaryInstance for single-instance gating on Windows and Linux.
Adds exposeClerkBridge() from @clerk/electron/preload to publish the renderer-side IPC bridge from the preload script with contextIsolation enabled.
Adds storage() from @clerk/electron/storage as a pluggable session-token storage adapter backed by electron-store@8.
Adds VITE_CLERK_PUBLISHABLE_KEY and VITE_CLERK_FRONTEND_API_HOST .env keys for configuring the Electron renderer's Clerk credentials.

+3 more show less

Adds PATCH /v1/instance (allowed_origins) API call to allowlist the renderer's origin (e.g. http://localhost:5173) on the Clerk Frontend API.
Adds Native API enablement in the Clerk Dashboard under the Native applications page, required for native app and browser-extension integrations.
Supports <ClerkProvider> and Clerk's prebuilt React components inside the Electron renderer process via @clerk/electron/react.

8 details in Everything

docs update Sep 30, 2026 · issue 090

Clerk adds an Electron SDK for desktop app authentication using the same web components.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

announced Sep 30, 2026 · issue 093

Clerk adds accountless setup via npx clerk@latest init, letting agents and developers get API keys without signing up.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Bootstrap Clerk auth in a new Next.js project — no account, no Dashboard, no copy-pasting keys — so an agent can continue immediately.

$ npx clerk@latest init

Pull production keys into a dedicated file to keep them out of the dev env file your local server reads.

$ npx clerk@latest env pull --instance prod --file .env.production.local

Let an agent audit the Clerk setup and parse structured remedies without triggering interactive prompts.

$ npx clerk@latest doctor --json

Adds npx clerk@latest init to scaffold Clerk into a Next.js project and write development keys without a Clerk account or Dashboard login.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds --accountless flag to npx clerk@latest init to force accountless app creation even when signed in, and --login to force the authenticated flow.
Adds npx clerk@latest link (with optional --app <id>) to attach an existing Clerk app to a project instead of creating a new one.
Adds npx clerk@latest env pull to write a linked app's development keys into the local env file, and --instance prod to pull production keys instead.
Adds --file <path> flag to npx clerk@latest env pull to write keys to a specific env file instead of the auto-detected default.

+6 more show less

Adds npx clerk@latest doctor to inspect CLI session, linked application, and project health, reporting each failing check with a remedy.
Adds --fix flag to npx clerk@latest doctor to automatically apply remediable issues (signing in, linking the project, running env pull).
Adds --json flag to npx clerk@latest doctor so agents can parse structured output including the remedy field instead of interactive prompts.
Adds npx clerk@latest deploy as an interactive wizard to create a production Clerk instance and walk through DNS records and OAuth providers.
Adds npx clerk@latest auth login to sign in and claim an accountless application, attaching it to a Clerk account.
Starting in @clerk/nextjs 7.8.0, an app without Clerk keys throws a structured error instructing users or agents to run npx clerk@latest init.

11 details in Everything

Self-serve Directory Sync (2026-09-30) Sep 30, 2026 · issue 091

IT admins can now self-configure Directory Sync from the Security tab in <OrganizationProfile />, removing the need for developer intervention.

New integration Self-serve Directory Sync via OrganizationProfile

Self-serve Directory Sync Sep 30, 2026 · release notes

Adds self-serve Directory Sync setup in OrganizationProfile Security tab for customer IT admins

Allows customer IT admins to configure Directory Sync (Google Workspace, Okta, Entra ID) via a wizard in the <OrganizationProfile /> Security tab
Generates SCIM endpoints and bearer tokens automatically for standard IdPs during the self-serve setup process
Requires enabling 'Allow this organization to set up enterprise SSO and Directory Sync' under Organization permissions in the Clerk Dashboard

3 details in Everything

SSO bypass (2026-09-29) Sep 29, 2026 · issue 090

Clerk lets specific users bypass enterprise SSO and sign in with an email code when their SSO connection is unavailable.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SSO bypass Sep 29, 2026 · release notes

Adds SSO bypass allowlist via Backend API and Security tab to permit email code login during IdP outages

Allows users on a verified email allowlist to sign in with an Email verification code when their enterprise SSO identity provider is unavailable
Exposes sign_in.sso_bypass.succeeded event in Application Logs to record each successful bypass session
Provides org:sys_entconns_sso_bypass:manage system permission for Organization members to manage the allowlist from the Security tab

3 details in Everything

changelog Sep 26, 2026 · issue 086

Clerk: Enables Publish CIMD support toggle under Client onboarding in OAuth application settings, letting MCP and other public OAuth clients authenticate via HTTPS URL as client_id without a pre-issued secret or Dynamic Client Registration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Lock down your MCP server's OAuth flow to only pre-reviewed clients after enabling Client ID Metadata Document support.

📍In the Clerk Dashboard, go to OAuth applications settings › Client onboarding, enable Publish CIMD support, then set Client admission to Pre-registered clients only and add trusted client ID URLs from the Applications tab.

Investigate a user-reported missing SMS verification code by filtering SMS logs to their phone number and checking the normalized failure reason.

📍In the Clerk Dashboard, open the SMS logs view, filter by the destination phone number, and inspect the sms.failed or sms.undeliverable event's reason field (e.g. invalid_phone_number or destination_unreachable) to determine the remediation action.

Support an enterprise customer who uses two separate identity providers (e.g. post-acquisition) within a single Clerk Organization.

📍In the Clerk Dashboard, go to SSO connections, select the Organization that already has a SAML or OIDC connection, and add a second connection with its own domain, protocol, and Directory Sync settings.

Adds Client admission control to OAuth application settings, with a Pre-registered clients only mode to restrict flows to reviewed clients.
Introduces SMS delivery events (sms.accepted, sms.delivered, sms.failed, sms.undeliverable, sms.unconfirmed) with a normalized reason field (e.g. invalid_phone_number, destination_unreachable, rate_limited) logged in a dedicated SMS logs view for all plans.
Allows Organizations to have more than one SAML or OIDC enterprise connection simultaneously, removing the previous organization_already_has_sso_connection limit, across the Clerk Dashboard and Backend API.
Enables a single Organization to receive Directory Sync feeds from multiple directories, with per-directory membership and deprovisioning tracked independently.

Adds Client admission control to OAuth application settings, with a Pre-registered clients only mode to restrict flows to reviewed clients.
Introduces SMS delivery events (sms.accepted, sms.delivered, sms.failed, sms.undeliverable, sms.unconfirmed) with a normalized reason field (e.g. invalid_phone_number, destination_unreachable, rate_limited) logged in a dedicated SMS logs view for all plans.

2 more in Everything

changelog Sep 25, 2026 · issue 085

Clerk adds multi-IdP enterprise SSO per Organization, GA Client ID Metadata Documents, and SMS delivery event logs⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Allow MCP or other public OAuth clients to authenticate using a URL as their client_id without pre-registering a secret, then restrict flows to only reviewed clients.

📍In the Clerk Dashboard, go to OAuth applications settings › Client onboarding, enable Publish CIMD support, then set Client admission to Pre-registered clients only and add trusted client ID URLs from the Applications tab.

Federate a post-acquisition org whose employees sign in through two separate IdPs by adding a second SAML or OIDC connection to the same Organization.

📍In the Clerk Dashboard, go to the SSO connections page, select the target Organization, and add a second enterprise connection with its own domain and Directory Sync configuration.

Enables Publish CIMD support toggle in the OAuth applications settings page under Client onboarding, with a Client admission control (Pre-registered clients only) and per-client scope management via the Applications tab — making Client ID Metadata Documents generally available for all applications.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds SMS delivery event logging with five normalized event types — sms.accepted, sms.delivered, sms.failed, sms.undeliverable, and sms.unconfirmed — each carrying a reason field (e.g. invalid_phone_number, destination_unreachable, rate_limited) and full trace linking across a message's lifecycle.
Adds a dedicated SMS logs view filterable by event type (e.g. sms.failed) or destination phone number, available on all plans as part of Application Logs.
Removes the one-enterprise-connection-per-Organization limit across the Clerk Dashboard and Backend API, allowing multiple SAML or OIDC connections — each with its own domain, protocol, and Directory Sync — on a single Organization.
Supports multi-directory membership resolution: a user's active status and Organization membership are recalculated across all enabled directories, with deactivation or membership removal triggered only when every managing directory has deprovisioned them.

Enables Publish CIMD support toggle in the OAuth applications settings page under Client onboarding, with a Client admission control (Pre-registered clients only) and per-client scope management via the Applications tab — making Client ID Metadata Documents generally available for all applications.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds SMS delivery event logging with five normalized event types — sms.accepted, sms.delivered, sms.failed, sms.undeliverable, and sms.unconfirmed — each carrying a reason field (e.g. invalid_phone_number, destination_unreachable, rate_limited) and full trace linking across a message's lifecycle.
Adds a dedicated SMS logs view filterable by event type (e.g. sms.failed) or destination phone number, available on all plans as part of Application Logs.
Supports multi-directory membership resolution: a user's active status and Organization membership are recalculated across all enabled directories, with deactivation or membership removal triggered only when every managing directory has deprovisioned them.

1 more in Everything

changelog Sep 24, 2026 · issue 084

Clerk: Enables Publish CIMD support in OAuth application settings so MCP and other public OAuth clients can identify themselves via an HTTPS URL as their client_id, without a pre-issued client secret or Dynamic Client Registration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Lock your OAuth server to only clients you have explicitly reviewed, preventing unknown public clients from initiating flows.

📍In the Clerk Dashboard, go to OAuth applications settings › Client onboarding. Enable Publish CIMD support, then set Client admission to Pre-registered clients only and add trusted clients from the Applications tab.

Investigate why a user did not receive their verification code by filtering SMS delivery events to a single phone number.

📍In the Clerk Dashboard, open the SMS logs view under Application Logs and filter by the destination phone number. Check for sms.failed or sms.undeliverable events and inspect the reason field (e.g. invalid_phone_number, destination_unreachable, rate_limited) to determine the corrective action.

Adds an SMS logs view in Application Logs with five delivery event types — sms.accepted, sms.delivered, sms.failed, sms.undeliverable, and sms.unconfirmed — for phone verification codes, OTPs, and password reset codes.
Groups all events for a single SMS message under a shared trace, enabling end-to-end timeline reconstruction for a single recipient.

2 details in Everything

Multiple enterprise connections per Organization (2026-09-24) Sep 24, 2026 · issue 085

Clerk Organizations can now link multiple SAML or OIDC enterprise connections, enabling multi-directory user provisioning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Supports linking multiple SAML or OIDC enterprise connections to a single Organization, allowing more than one directory to provision the same user.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 detail in Everything

Multiple enterprise connections per Organization Sep 24, 2026 · release notes

Allow multiple SAML/OIDC enterprise connections per Organization and merged directory sync status

└──▷ HOW TO FIND IT

Add a second SSO provider to an existing Organization via the Dashboard without errors.

📍In the Clerk Dashboard, navigate to the SSO connections page and add a new connection for an Organization that already has one.

Removes the organization_already_has_sso_connection limit so an Organization can link several SAML or OIDC connections for multi-IdP scenarios
Merges Directory Sync status across multiple connections so a user remains active while at least one enabled directory reports them as active
Decouples organization membership and role mapping per directory, withdrawing access only from the specific directory that deprovisions the user

3 details in Everything

changelog Sep 23, 2026 · issue 083

Clerk: Adds SMS delivery event logging with five typed events — sms.accepted, sms.delivered, sms.failed, sms.undeliverable, and sms.unconfirmed — available in the SMS logs view under Application Logs on all plans.

└──▷ HOW TO FIND IT

Enable CIMD support so MCP clients can authenticate using an HTTPS URL as their client_id without pre-registration or a client secret.

📍1. In the Clerk Dashboard, go to OAuth applications settings. 2. Under Client onboarding, enable Publish CIMD support. 3. Optionally set Client admission to Pre-registered clients only and add trusted clients from the Applications tab.

Investigate a user-reported missing SMS verification code by filtering delivery events to that recipient's number.

📍1. In the Clerk Dashboard, open the SMS logs view. 2. Filter by the destination phone number or by event type sms.failed or sms.undeliverable. 3. Select a message to see its full delivery trace and the normalized reason field (e.g. invalid_phone_number, destination_unreachable, rate_limited).

changelog Sep 22, 2026 · issue 082

Clerk adds Client ID Metadata Documents (GA) and SMS delivery event logs with per-event failure reasons⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Investigate why a user did not receive an SMS verification code by filtering the SMS logs to only failed delivery events for their number.

📍In the Clerk Dashboard, go to Logs › SMS logs view, filter by event type sms.failed, then enter the destination phone number to pull up that recipient's full delivery trace.

Lock your MCP server's OAuth flow so only clients you have explicitly reviewed can authenticate, using CIMD admission controls.

📍In the Clerk Dashboard, go to OAuth applications settings › Client onboarding, enable Publish CIMD support, then set Client admission to Pre-registered clients only and add trusted client ID URLs from the Applications tab.

Adds sms.accepted, sms.delivered, sms.failed, sms.undeliverable, and sms.unconfirmed SMS delivery events to Application Logs, with a normalized reason field (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ invalid_phone_number, destination_unreachable, rate_limited) on failure events.
Adds a dedicated SMS logs view that lets you filter SMS delivery events by event type (e.g. sms.failed) or destination phone number, with full per-message trace timelines.
Adds Client admission control to CIMD settings, allowing operators to restrict OAuth flows to pre-reviewed clients by setting Client admission to Pre-registered clients only.
Adds Publish CIMD support toggle to the OAuth applications settings page under Client onboarding, enabling CIMD in the authorization server metadata.

4 details in Everything

docs update Sep 22, 2026 · issue 082

Clerk CLI gains init, enable orgs, config patch, and apps list commands for agent-driven, zero-account Next.js setup⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Bootstrap Clerk in a new or existing Next.js project without a Clerk account — keys are written to .env.local automatically.

$ npx -y clerk@latest init

Connect a project to an existing Clerk application by choosing from all applications visible to the signed-in account.

$ npx -y clerk@latest apps list --json
# Review names and IDs, then:
npx -y clerk@latest init --app <application_id>

Enable organizations on a freshly provisioned, not-yet-claimed application before handing it to the user to claim.

$ npx -y clerk@latest enable orgs

Adds npx -y clerk@latest init to provision a claimable Clerk application, write NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY and CLERK_SECRET_KEY to .env.local, and configure the SDK, <ClerkProvider>, middleware, and auth routes — no Clerk account required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds npx -y clerk@latest init --app <application_id> to wire an existing Clerk application into the project instead of provisioning a new one.
Adds npx -y clerk@latest apps list --json to enumerate existing Clerk applications by name and ID.
Adds npx -y clerk@latest enable orgs to enable organizations on a not-yet-claimed application.
Adds npx -y clerk@latest config patch to update configuration on a not-yet-claimed application.

+3 more show less

Names the middleware file by Next.js version: proxy.ts on Next.js 16+, middleware.ts on Next.js 15 and below — contents are identical and the file is created automatically by init.
Supports running Clerk CLI through any major package runner: npx -y clerk@latest, pnpm dlx clerk@latest, bunx clerk@latest, or yarn dlx clerk@latest (Yarn 2+ only).
Detects agent environments and runs init non-interactively so no keys pass through the conversation.

8 details in Everything

2026-05-12 Sep 21, 2026 · issue 081

API surface changed: +1 endpoint, 2 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

API change

API surface changed: +1 endpoint, 2 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

+ GET /sessions/{session_id}/reverifications/{reverification_id}
~ POST /domains: request body changed
~ POST /phone_numbers/{phone_number_id}/attempt_verification: response schema changed

New endpoint GET /sessions/{session_id}/reverifications/{reverification_id}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 detail in Everything

Client ID Metadata Documents are now generally available (2026-09-21) Sep 21, 2026 · issue 082

Client ID Metadata Documents (CIMD) are now generally available for all Clerk applications, enabling URL-based OAuth client identity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Client ID Metadata Documents are now generally available Sep 21, 2026 · release notes

Client ID Metadata Documents (CIMD) generally available for all Clerk applications

Publish CIMD support setting enables publishing of Client ID Metadata Documents in authorization server metadata.
Client admission setting allows restricting OAuth flows to Pre-registered clients only or explicitly allowed client URL.

2 details in Everything

Trace SMS delivery in Application Logs (2026-09-17) Sep 17, 2026 · issue 079

Clerk Application Logs now expose the full delivery lifecycle of every SMS message sent through Clerk.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds SMS delivery lifecycle tracking to Application Logs, letting teams trace the status of every Clerk-delivered SMS.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 detail in Everything

Trace SMS delivery in Application Logs Sep 17, 2026 · release notes

Clerk Application Logs now record SMS delivery events (accepted, delivered, failed) with dedicated filtering view

sms.accepted, sms.delivered, sms.failed, sms.undeliverable, and sms.unconfirmed event types are now recorded in Application Logs for all Clerk-sent SMS messages.
A dedicated SMS logs view is added to the UI, allowing filtering by event type (e.g., sms.failed) or destination phone number.
Failure events include a normalized reason field (e.g., invalid_phone_number, destination_unreachable, rate_limited) to distinguish root causes.

3 details in Everything

2026-05-12 Sep 14, 2026 · issue 074

API change

+ DELETE /users/{user_id}/biometric_credentials/{biometric_credential_id}
+ GET /users/{user_id}/biometric_credentials
~ PATCH /instance: request body changed
~ PATCH /instance/oauth_application_settings: request body changed
~ PATCH /oauth_applications/{oauth_application_id}: request body changed
~ PATCH /organizations/{organization_id}: request body changed
~ POST /actor_tokens: response schema changed
~ POST /directories/{directory_id}/rotate_api_key: response schema changed
~ POST /oauth_applications: request body changed
~ POST /scim_directories/{scim_directory_id}/rotate_api_key: response schema changed
~ POST /users: request body changed
⚠ DELETE /users/{user_id}/trusted_devices/{trusted_device_id}
⚠ GET /users/{user_id}/trusted_devices

└──▷ BREAKING ON UPGRADE

!Deprecated endpoint DELETE /users/{user_id}/trusted_devices/{trusted_device_id} (still works)
!Deprecated endpoint GET /users/{user_id}/trusted_devices (still works)

2026-05-12 Sep 13, 2026 · issue 073

API surface changed: +2 endpoints, 9 modified, 2 deprecated⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

API change

API surface changed: +2 endpoints, 9 modified, 2 deprecated⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

+ DELETE /users/{user_id}/biometric_credentials/{biometric_credential_id}
+ GET /users/{user_id}/biometric_credentials
~ PATCH /instance: request body changed
~ PATCH /instance/oauth_application_settings: request body changed
~ PATCH /oauth_applications/{oauth_application_id}: request body changed
~ PATCH /organizations/{organization_id}: request body changed
~ POST /actor_tokens: response schema changed
~ POST /directories/{directory_id}/rotate_api_key: response schema changed
~ POST /oauth_applications: request body changed
~ POST /scim_directories/{scim_directory_id}/rotate_api_key: response schema changed
~ POST /users: request body changed
⚠ DELETE /users/{user_id}/trusted_devices/{trusted_device_id}
⚠ GET /users/{user_id}/trusted_devices

New endpoint DELETE /users/{user_id}/biometric_credentials/{biometric_credential_id}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
New endpoint GET /users/{user_id}/biometric_credentials

2 details in Everything

└──▷ BREAKING ON UPGRADE

!Deprecated endpoint DELETE /users/{user_id}/trusted_devices/{trusted_device_id} (still works)
!Deprecated endpoint GET /users/{user_id}/trusted_devices (still works)

changelog Sep 13, 2026 · issue 073

Clerk: Adds OAuth 2.0 Device Authorization Grant (beta, RFC 8628) for applications that cannot open a browser or accept text input — CLIs, TVs, game consoles — letting users approve access from a separate browser-capable device.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Supports both public clients (Client ID only) and confidential clients (Client ID + Client Secret) for device authorization flows.
Automatically advertises device_authorization_endpoint and urn:ietf:params:oauth:grant-type:device_code in OAuth 2.0 and OpenID Connect metadata when Device Authorization Grant is available and the verification page is reachable.

2 details in Everything

2026-05-12 Sep 12, 2026 · issue 072

API change

+ DELETE /users/{user_id}/biometric_credentials/{biometric_credential_id}
+ GET /users/{user_id}/biometric_credentials
~ PATCH /instance: request body changed
~ PATCH /instance/oauth_application_settings: request body changed
~ PATCH /oauth_applications/{oauth_application_id}: request body changed
~ PATCH /organizations/{organization_id}: request body changed
~ POST /actor_tokens: response schema changed
~ POST /directories/{directory_id}/rotate_api_key: response schema changed
~ POST /oauth_applications: request body changed
~ POST /scim_directories/{scim_directory_id}/rotate_api_key: response schema changed
~ POST /users: request body changed
⚠ DELETE /users/{user_id}/trusted_devices/{trusted_device_id}
⚠ GET /users/{user_id}/trusted_devices

└──▷ BREAKING ON UPGRADE

!Deprecated endpoint DELETE /users/{user_id}/trusted_devices/{trusted_device_id} (still works)
!Deprecated endpoint GET /users/{user_id}/trusted_devices (still works)

changelog Sep 12, 2026 · issue 072

Clerk adds OAuth 2.0 Device Authorization Grant (beta) for CLIs, TVs, and input-constrained devices.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds support for device_authorization_endpoint and grant type urn:ietf:params:oauth:grant-type:device_code advertised automatically via OAuth 2.0 and OpenID Connect metadata when Device Authorization Grant is enabled.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Clerk's Account Portal hosts user verification for device flows, displaying the OAuth application, requested scopes, optional Organization selection, and approve/deny actions.

2 details in Everything

2026-05-12 Sep 11, 2026 · issue 071

API change

+ DELETE /users/{user_id}/biometric_credentials/{biometric_credential_id}
+ GET /users/{user_id}/biometric_credentials
~ PATCH /instance: request body changed
~ PATCH /instance/oauth_application_settings: request body changed
~ PATCH /oauth_applications/{oauth_application_id}: request body changed
~ PATCH /organizations/{organization_id}: request body changed
~ POST /actor_tokens: response schema changed
~ POST /directories/{directory_id}/rotate_api_key: response schema changed
~ POST /oauth_applications: request body changed
~ POST /scim_directories/{scim_directory_id}/rotate_api_key: response schema changed
~ POST /users: request body changed
⚠ DELETE /users/{user_id}/trusted_devices/{trusted_device_id}
⚠ GET /users/{user_id}/trusted_devices

└──▷ BREAKING ON UPGRADE

!Deprecated endpoint DELETE /users/{user_id}/trusted_devices/{trusted_device_id} (still works)
!Deprecated endpoint GET /users/{user_id}/trusted_devices (still works)

changelog Sep 11, 2026 · issue 071

Clerk adds device authorization metadata so OAuth clients can discover the enabled grant automatically.

Adds OAuth 2.0 Device Authorization Grant (RFC 8628) beta support, letting CLIs, TVs, game consoles, and other browserless devices obtain tokens by having a user approve access on a separate browser-capable device.
Device Authorization Grant shares Clerk OAuth scopes, tokens, consent context, and Organization claims with the Authorization Code Flow; PKCE and redirect URIs are not used.

2 details in Everything

2026-05-12 Sep 10, 2026 · issue 070

API surface changed: +2 endpoints, 9 modified, 2 deprecated⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

API change

API surface changed: +2 endpoints, 9 modified, 2 deprecated⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

+ DELETE /users/{user_id}/biometric_credentials/{biometric_credential_id}
+ GET /users/{user_id}/biometric_credentials
~ PATCH /instance: request body changed
~ PATCH /instance/oauth_application_settings: request body changed
~ PATCH /oauth_applications/{oauth_application_id}: request body changed
~ PATCH /organizations/{organization_id}: request body changed
~ POST /actor_tokens: response schema changed
~ POST /directories/{directory_id}/rotate_api_key: response schema changed
~ POST /oauth_applications: request body changed
~ POST /scim_directories/{scim_directory_id}/rotate_api_key: response schema changed
~ POST /users: request body changed
⚠ DELETE /users/{user_id}/trusted_devices/{trusted_device_id}
⚠ GET /users/{user_id}/trusted_devices

New endpoint DELETE /users/{user_id}/biometric_credentials/{biometric_credential_id}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
New endpoint GET /users/{user_id}/biometric_credentials

2 details in Everything

└──▷ BREAKING ON UPGRADE

!Deprecated endpoint DELETE /users/{user_id}/trusted_devices/{trusted_device_id} (still works)
!Deprecated endpoint GET /users/{user_id}/trusted_devices (still works)

changelog Sep 10, 2026 · issue 070

Clerk: Adds OAuth 2.0 Device Authorization Grant (beta, RFC 8628) for clients that cannot open a browser — CLIs, TVs, game consoles — enabling device-code polling flows without redirect URIs or PKCE.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Supports both public clients (Client ID only) and confidential clients (Client ID + Client Secret) in the Device Authorization Grant flow.

1 detail in Everything

changelog Sep 9, 2026 · issue 069

Clerk: Supports both public clients (Client ID only) and confidential clients (Client ID + Client Secret) in the device flow.

Clerk's Account Portal serves as the hosted verification page, presenting the OAuth application name, requested scopes, Organization selection, and approve/deny actions to the authorizing user.
Automatically advertises device_authorization_endpoint and grant type urn:ietf:params:oauth:grant-type:device_code via OAuth 2.0 and OpenID Connect metadata discovery when Device Authorization Grant is enabled and the verification page is reachable.

2 details in Everything

OAuth Device Authorization Grant (2026-09-08) Sep 8, 2026 · issue 069

Clerk adds OAuth Device Authorization Grant support for CLIs, TVs, and input-constrained devices.

OAuth Device Authorization Grant Sep 8, 2026 · release notes

Clerk now supports OAuth Device Authorization Grant (RFC 8628) for CLIs and input-constrained devices.

Adds device_authorization_endpoint to the OAuth 2.0 / OIDC metadata discovery response when the grant is available
Introduces support for urn:ietf:params:oauth:grant-type:device_code as a new grant type in token requests
Enables public client flows using only Client ID, and confidential client flows using Client ID and Client Secret
Adds hosted verification in Clerk Account Portal for approving or denying access requested by input-constrained devices.

4 details in Everything

docs update Sep 5, 2026 · issue 065

Clerk adds AI-native developer tooling: MCP server, Skills packages, Agent Tasks, CLI, and an AI prompt library

└──▷ TRY IT

Bootstrap a new project with Clerk authentication from the terminal and automatically install Clerk Skills so your AI coding agent has full Clerk context.

$ npx clerk@latest init

Register Clerk's MCP server across all AI clients on your machine so agents can generate accurate SDK snippets and implementation patterns.

$ clerk mcp install

Give your AI coding agent specialized Clerk knowledge so it can help implement authentication, manage Organizations, and sync users correctly.

$ npx skills add clerk/skills

Adds npx clerk@latest init CLI command to set up and manage Clerk authentication from the terminal, with auto-detection of agent vs. human mode and the ability to install Clerk Skills for AI agents.
Adds clerk mcp install command to register Clerk's MCP server in all AI clients detected on the local machine in one step.
Adds npx skills add clerk/skills to install Clerk Skills — packages that give AI coding agents (Claude Code, Cursor, Windsurf, GitHub Copilot, Codex, Gemini CLI, and others) specialized knowledge about Clerk authentication, Organizations, and user sync.
Adds Agent Tasks, enabling the creation of authenticated sessions on behalf of users without the standard sign-in flow, designed for AI agent workflows.
Adds MCP server support via Client ID Metadata Documents (CIMD), Dynamic Client Registration, OAuth consent screens, and SDK support, with guides for building both an MCP server and an MCP client using Clerk.

+1 more show less

Adds an AI prompt library with curated prompts for Cursor, Claude Code, Codex, GitHub Copilot, and other AI-powered development tools to guide correct Clerk feature implementation.

6 details in Everything

docs update Sep 5, 2026 · issue 065

Clerk CLI adds clerk init for accountless, agent-friendly auth setup — no browser or API keys needed.

└──▷ TRY IT

Bootstrap a new Next.js app with Clerk auth from scratch — no account or API keys needed — so CI agents or onboarding scripts can run end-to-end without human interaction.

$ clerk init

Enable organizations on a provisioned-but-unclaimed Clerk app directly from the terminal before signing in.

$ clerk enable orgs

Patch configuration on an accountless Clerk app (e.g. adjust auth settings) before claiming it with a full account.

$ clerk config patch

Adds clerk init CLI command that provisions a claimable Clerk app, writes dev keys to .env.local, and wires up the SDK, provider, middleware, and auth routes — no Clerk account required.
Adds clerk enable orgs and clerk config patch CLI commands for configuring accountless apps before claiming.
Supports agent/non-interactive mode via clerk init: detects agent environments and runs fully non-interactive so no step blocks waiting on user input or passes keys through a conversation.

3 details in Everything

changelog Sep 2, 2026 · issue 062

Clerk adds a 1–10 minute Reverification window in Dashboard Sessions, limiting how long sensitive-action reverification remains valid.

└──▷ HOW TO FIND IT

Reduce the reverification window so users must re-verify more frequently before sensitive actions like deleting their account.

📍In the Clerk Dashboard, go to Sessions › Session lifetime › Reverification window and set the value to a number between 1 and 10 minutes.

Review all OAuth application changes made across your workspace in the last 24 hours by filtering Admin Logs by event type wildcard.

📍In the Clerk Dashboard, open Admin Logs, then set the Event type filter to oauth_application.* and scope the Time range to the desired window.

Adds Admin Logs to the Clerk Dashboard: a reverse-chronological audit trail of configuration changes made via the Dashboard, Backend API, or Platform API, with filters for Event type (supports trailing wildcards, e.g. oauth_application.*), Instance, Application, Actor, IP address, and Time range; available on Business and Enterprise plans.
Adds biometric credential APIs to Clerk's mobile SDKs — useBiometricCredentials (React Native/Expo), Clerk.shared.biometricCredentials.signInWithBiometrics and Clerk.shared.biometricCredentials.biometricCredentialId (Swift), and Clerk.biometricCredentials.signInWithBiometrics and Clerk.biometricCredentials.biometricCredentialId (Android) — enabling enrollment and sign-in via Face ID, Touch ID, or Android biometrics with a device-bound private key.

2 details in Everything

changelog Sep 1, 2026 · issue 061

Clerk adds Admin Logs audit trail, configurable reverification window, and biometric credential enrollment for mobile SDKs

└──▷ HOW TO FIND IT

Shorten the reverification window to 2 minutes so users must re-authenticate frequently before sensitive actions like password changes.

📍In the Clerk Dashboard, go to Sessions › Session lifetime › Reverification window and set the value to 2 (minutes).

Filter Admin Logs to see all OAuth application events across your workspace using a trailing wildcard event type.

📍In the Clerk Dashboard, open Admin Logs, select the Event type filter, and enter oauth_application.* to see all OAuth application events.

New Reverification window setting on the Sessions page in the Clerk Dashboard lets you configure how long a successful reverification remains valid, from 1 to 10 minutes (default: 10 minutes), controlling how frequently users must re-authenticate before sensitive actions such as changing a password, adding/removing an email address, revoking a session, or deleting an account.
New Admin Logs section in the Clerk Dashboard provides a reverse-chronological audit trail of configuration changes made via the Dashboard, Backend API, or Platform API — tracking events such as creating OAuth applications, updating instance settings, rotating secrets, and managing Roles and Permissions.
Admin Logs support filtering by Event type (with trailing wildcard support, e.g. oauth_application.*), Instance, Application, Actor, IP address, and Time range; available on Business and Enterprise plans, recording from August 24, 2026 onward.
Clerk mobile SDKs now support biometric credential enrollment and sign-in (Face ID, Touch ID, Android biometrics) via useBiometricCredentials (React Native), Clerk.shared.biometricCredentials.signInWithBiometrics and Clerk.shared.biometricCredentials.biometricCredentialId (Swift), and Clerk.biometricCredentials.signInWithBiometrics and Clerk.biometricCredentials.biometricCredentialId (Android), with the private key remaining device-bound.

4 details in Everything

Customize the reverification window (2026-08-28) Aug 28, 2026 · issue 058

Clerk lets you control how recently users must have authenticated before they can perform sensitive actions.

Adds the ability to customize the reverification window, defining how recently a user must have authenticated before sensitive actions are permitted.

1 detail in Everything

docs update Aug 26, 2026 · issue 057

Clerk adds MFA account recovery support, letting you reset lost second factors via the Backend API.

changelog Aug 25, 2026 · issue 056

Clerk adds custom OAuth scopes for MCP clients and biometric trusted-device sign-in for mobile SDKs

└──▷ USE IT

Enroll the current device for biometric sign-in in an Expo app so returning users can authenticate with Face ID or Touch ID instead of a password.

javascript

import { useTrustedDevices } from '@clerk/expo';

const { enroll } = useTrustedDevices();
await enroll();

Authenticate a returning user on iOS using a device-bound biometric challenge instead of credentials.

swift

await Clerk.shared.auth.signInWithTrustedDevice()

Define and assign custom OAuth scopes for an MCP client in the Clerk Dashboard so it can only request the permissions your API exposes.

📍In the Clerk Dashboard, go to Scopes and create custom scopes (e.g. messages:read, tools:execute, resources/files:read, mcp_all). Then open your OAuth application settings and assign only the scopes it requires. Under OAuth metadata settings, choose which scopes to advertise so MCP clients can discover them.

Adds custom OAuth scope definitions in the Clerk Dashboard (examples: messages:read, tools:execute, resources/files:read, mcp_all) so MCP clients can request only the access each OAuth application needs.
Adds OAuth metadata advertisement control so MCP clients can discover which scopes your application supports via Clerk's OAuth metadata endpoint.
Adds useTrustedDevices hook in @clerk/expo with enroll, signIn, and revoke methods to register a device and authenticate returning users with Face ID, Touch ID, or Android biometrics.
Adds Clerk.shared.trustedDevices.enroll, Clerk.shared.auth.signInWithTrustedDevice, and Clerk.shared.trustedDevices.revoke(id: trustedDeviceId) APIs for iOS trusted-device biometric sign-in.
Adds Clerk.trustedDevices.enroll, signInWithTrustedDevice, and Clerk.trustedDevices.revoke(trustedDeviceId) APIs for Android trusted-device biometric sign-in.

+1 more show less

Prebuilt auth and user profile views now surface a biometric enrollment prompt, biometric sign-in button, and current-device toggle without custom code.

6 details in Everything

Audit Dashboard activity with Admin Logs (2026-08-25) Aug 25, 2026 · issue 057

Clerk adds Admin Logs to give teams an audit trail of admin actions across their workspace.

└──▷ HOW TO FIND IT

Review recent admin activity across your workspace to investigate a suspicious change.

📍In the Clerk Dashboard, go to Admin Logs to view a chronological audit trail of admin actions across your workspace.

docs update Aug 22, 2026 · issue 053

Clerk CLI adds npx clerk@latest init for zero-config auth setup with auto-generated dev keys and npx clerk@latest doctor verification

└──▷ TRY IT

Scaffold a new project in an empty directory with a specific framework and package manager, then verify the setup is correct.

$ npx clerk@latest init --framework react --pm pnpm && npx clerk@latest doctor

Apply the shadcn/ui theme to Clerk components when the project already uses shadcn/ui.

javascript

import { shadcn } from '@clerk/ui/themes'
// in your provider:
<ClerkProvider appearance={{ theme: shadcn }}>{children}</ClerkProvider>

Adds npx clerk@latest init CLI command that auto-detects framework and package manager, installs the SDK, and wires up provider, middleware, auth routes, and env file — supporting Next.js, React, React Router, Nuxt, TanStack Start, Astro, Vue, JavaScript/Vite, Expo, Express, Fastify, iOS, and Android.
Adds temporary development keys support: when the framework supports it, npx clerk@latest init writes dev keys to the project env file so no Clerk account is required upfront; the app is claimed later via npx clerk@latest auth login.
Adds --framework <framework> and --pm <package-manager> flags to npx clerk@latest init for overriding auto-detected framework and package manager in empty directories.
Adds --app <application_id> flag to npx clerk@latest init for linking an existing Clerk application.
Adds npx clerk@latest apps list --json subcommand to list available Clerk applications with their names and IDs.

+3 more show less

Adds npx clerk@latest doctor command to verify auth setup and report configuration issues after initialization.
Adds npx clerk@latest enable orgs command to enable Organizations (multi-tenancy, team invitations, roles and permissions, enterprise SSO) on an existing project.
Adds @clerk/ui package with shadcn/ui theme integration: apply via appearance={{ theme: shadcn }} on ClerkProvider and @import '@clerk/ui/themes/shadcn.css' in global CSS.

8 details in Everything

Custom OAuth scopes (2026-08-21) Aug 21, 2026 · issue 053

Clerk adds custom OAuth scopes for precise, discoverable MCP client access control.

changelog Aug 18, 2026 · issue 049

Clerk Billing adds discounts and promo codes — apply percentage or fixed-amount deals to subscriptions or share redeemable codes at checkout.

Adds discount support to Clerk Billing: create reusable percentage or fixed-amount discounts and apply them manually to any active subscriber's subscription from the Dashboard, with the ability to revoke at any time.
Adds promo codes (e.g. LAUNCH20) that customers can enter at checkout to self-redeem discounts, with optional redemption caps, new-subscriber restrictions, and per-code usage tracking.
Supports per-period discount amounts, letting you set different discount values for monthly and annual billing cycles.
Supports discount durations of a single billing cycle, a set number of cycles, or indefinitely.

4 details in Everything

Biometric sign-in for Expo, iOS, and Android (2026-08-17) Aug 17, 2026 · issue 050

Clerk adds biometric sign-in for returning users on Expo, iOS, and Android.

changelog Aug 10, 2026 · issue 041

Clerk adds CIMD beta for OAuth clients, Google Workspace Directory Sync, and strict enumeration protection for combined sign-in-or-up flows.

Adds organizations.title and customSchemas.<schema>.<field> (e.g., customSchemas.EmployeeInfo.costCenter) as mappable custom attribute paths in Google Workspace Directory Sync, including array paths for multi-valued attributes.
Adds signUpIfMissing option for custom sign-in flows to enable sign-in-or-up behavior without enabling strict enumeration protection globally.
Adds sign_up_if_missing_password_preferred console warning on development instances when <SignIn /> detects an incompatible strict-protection + password configuration.
New CIMD (Client ID Metadata Document) beta lets OAuth clients use an HTTPS URL as their client_id — Clerk fetches and validates the metadata document, eliminating the need for pre-issued client IDs, secrets, or Dynamic Client Registration; aimed at MCP and other public OAuth clients.
New CIMD Clients tab on the OAuth provider page lets admins explicitly allow clients by Client ID URL, assign scopes, review admission status and metadata fetch health, refresh metadata, and block or delete saved clients.

+6 more show less

New Advertise CIMD support toggle publishes CIMD in authorization server metadata, allowing any compatible client to connect; pairs with Only allow pre-registered clients to connect to restrict OAuth flows to pre-reviewed clients.
Directory Sync now supports Google Workspace: Clerk syncs users, groups, and group memberships via a Google service account with domain-wide delegation, without requiring sign-in events to trigger updates.
Google Workspace Directory Sync is configured in the Dashboard under a Google SAML connection's Directory sync tab by uploading a service account key and specifying the admin to impersonate.
Google groups synced via Directory Sync can be mapped to Clerk Roles.
<SignIn /> now supports strict user enumeration protection and sign-in-or-up together out-of-the-box, with no code changes required — verification occurs before Clerk decides whether to sign in or create an account.
Strict enumeration protection is enabled on the Dashboard's Rules page under Protect; existing apps using <SignIn /> as a combined sign-in-or-up page with public sign-ups continue working with no migration.

11 details in Everything

Discounts and promo codes for Billing (2026-08-10) Aug 10, 2026 · issue 042

Clerk Billing gains percentage and fixed-amount discounts plus redeemable promo codes at checkout.

Adds support for applying percentage or fixed-amount discounts directly to a customer's subscription in Clerk Billing.
Adds promo codes that customers can redeem at checkout.

2 details in Everything

docs update Aug 6, 2026 · issue 037

Clerk adds Device Trust: auto-requires a second factor on new-device password sign-ins without MFA enabled.

New Device Trust capability automatically requires a second factor when a user signs in with a password from a new device and has not enabled MFA.

1 detail in Everything

docs update Aug 6, 2026 · issue 037

Clerk adds community-maintained Flutter integration documentation.

Google Workspace Directory Sync (2026-08-05) Aug 5, 2026 · issue 037

Clerk adds Google Workspace Directory Sync with role mapping and custom attribute support.

Sign-in-or-up now works with strict enumeration protection (2026-08-04) Aug 4, 2026 · issue 036

Clerk's <SignIn /> component now supports the combined sign-in-or-up flow under strict user enumeration protection.

changelog Aug 2, 2026 · issue 033

Clerk adds self-serve OIDC SSO for org admins, hosted mobile auth, and composable profile UI building blocks.

└──▷ HOW TO FIND IT

Delegate OIDC enterprise SSO setup to an org admin — enable the capability per organization so the Security tab appears in OrganizationProfile.

📍In the Clerk Dashboard, select an Organization › Settings › Organization permissions, then toggle on "Allow this organization to set up enterprise SSO". The Security tab will now appear in <OrganizationProfile /> for admins with the org:sys_entconns:manage permission.

Offload the entire auth flow to Account Portal from an Expo app — no native auth UI needed, all instance auth methods work automatically.

javascript

import { useHostedAuth } from '@clerk/expo/hosted-auth'

const { startHostedAuth } = useHostedAuth()
await startHostedAuth()

Build a trimmed-down user profile page showing only the panels and sections your app needs, in the order you choose.

javascript

import {
  UserProfileProvider,
  UserProfileAccountPanel,
  UserProfileProfileSection,
  UserProfileEmailSection,
  UserProfilePhoneSection,
} from '@clerk/ui/experimental'

export default function Page() {
  return (
    <UserProfileProvider>
      <UserProfileAccountPanel>
        <UserProfileProfileSection />
        <UserProfileEmailSection />
        <UserProfilePhoneSection />
      </UserProfileAccountPanel>
    </UserProfileProvider>
  )
}

Adds OIDC provider support to Self-serve SSO, letting customers' IT admins configure custom OpenID Connect connections directly inside <OrganizationProfile /> without Dashboard access — domains are verified via DNS TXT record and the connection is scoped to the Organization.
New startHostedAuth() method in Expo, iOS, and Android SDKs hands the full sign-in/sign-up flow to Account Portal in a browser session, automatically covering all enabled auth methods (email codes, passwords, social, enterprise SSO, MFA) without requiring native UI.
Introduces experimental composable building blocks in @clerk/ui/experimental for assembling <UserProfile /> and <OrganizationProfile /> from individual panels and sections (e.g. UserProfileAccountPanel, UserProfileEmailSection, OrganizationProfileMembersPanel).

3 details in Everything

Self-serve SSO for OIDC (2026-07-31) Jul 31, 2026 · issue 032

Clerk lets end-customer IT admins self-configure OIDC SSO connections directly from the OrganizationProfile UI.

└──▷ HOW TO FIND IT

Surface the Security tab to your customers' IT admins so they can set up their own OIDC SSO without involving your support team.

📍In your app, render <OrganizationProfile /> and direct IT admins to the Security tab to configure their OpenID Connect connection.

Enables organization IT admins to configure their own OpenID Connect SSO connections self-serve via the Security tab in <OrganizationProfile />.

1 detail in Everything

docs update Jul 29, 2026 · issue 029

Clerk Expo SDK adds hosted authentication via Account Portal in-browser sessions alongside prebuilt native UI and custom flow options.

└──▷ USE IT

Trigger a hosted sign-up flow in an Expo app without building custom auth UI — Account Portal opens in a secure browser session and SDK state updates on return.

javascript

import { useHostedAuth } from '@clerk/expo/hosted-auth';

const { startHostedAuth } = useHostedAuth();

try {
  await startHostedAuth({ mode: 'sign-up' });
} catch (e) {
  // Handle the error in your app.
}

Adds hosted authentication flow for Expo apps via useHostedAuth from @clerk/expo/hosted-auth, opening Account Portal in a browser session without building custom UI.
Supports native prebuilt UI option rendering with SwiftUI on iOS and Jetpack Compose on Android for authentication screens.

2 details in Everything

Hosted authentication for Expo, iOS, and Android (2026-07-28) Jul 28, 2026 · issue 029

Clerk now supports hosted authentication via Account Portal for Expo, iOS, and Android apps.

Composable UserProfile and OrganizationProfile components (2026-07-27) Jul 27, 2026 · issue 028

Clerk introduces composable, experimental building-block APIs for UserProfile and OrganizationProfile pages.

changelog Jul 24, 2026 · issue 024

Clerk CLI gains a clerk mcp command group for one-command MCP server registration across 10 AI clients, plus configurable default OAuth scopes.

└──▷ TRY IT

Register the Clerk MCP server across all detected AI clients in one shot — useful for onboarding a new machine or CI environment.

$ clerk mcp install --all

Target only Claude Code and Cursor for MCP registration when you don't want to touch other clients on the machine.

$ clerk mcp install --client claude --client cursor

Verify your Clerk MCP server is reachable (not just installed) after registration, to catch config or network issues early.

$ clerk doctor

Adds clerk mcp install command that detects supported AI clients (Claude Code, Cursor, GitHub Copilot, Windsurf, Gemini CLI, Codex, opencode, OpenClaw, Warp, Hermes Agent) and registers the Clerk MCP server in each, user-globally, in a single interactive step.
Adds --client and --all flags to clerk mcp install for non-interactive, scripted registration targeting specific or all supported clients.
Adds clerk mcp run, a built-in stdio↔Streamable-HTTP bridge that replaces the npx mcp-remote dependency; updating the CLI updates the bridge everywhere with no re-install.
Adds clerk mcp list to display every Clerk MCP entry registered across all clients, and clerk mcp uninstall to remove them selectively.
Extends clerk doctor to probe the configured Clerk MCP server with a real initialize handshake, distinguishing not installed, installed but unreachable, and working states.

+1 more show less

Supports configuring default OAuth scopes for dynamic client registration via the OAuth Applications settings in the Clerk Dashboard or the Backend API, preventing invalid_scope errors when clients omit the scope parameter.

6 details in Everything

└──▷ BREAKING ON UPGRADE

!Beginning January 18, 2027, CBC-mode SSL/TLS cipher suites (including TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, and others) will be removed from Clerk-managed subdomains (clerk.example.com, accounts.example.com); clients that can only negotiate a CBC cipher will fail the TLS handshake after their subdomain's certificate rotates.

docs update Jul 24, 2026 · docs issue 004

Clerk CLI gains a clerk mcp command group for one-command MCP server registration across 10 AI clients, plus configurable default OAuth scopes.

└──▷ TRY IT

Register the Clerk MCP server across all detected AI clients in one shot — useful for onboarding a new machine or CI environment.

$ clerk mcp install --all

Target only Claude Code and Cursor for MCP registration when you don't want to touch other clients on the machine.

$ clerk mcp install --client claude --client cursor

Verify your Clerk MCP server is reachable (not just installed) after registration, to catch config or network issues early.

$ clerk doctor

Adds clerk mcp install command that detects supported AI clients (Claude Code, Cursor, GitHub Copilot, Windsurf, Gemini CLI, Codex, opencode, OpenClaw, Warp, Hermes Agent) and registers the Clerk MCP server in each, user-globally, in a single interactive step.
Adds --client and --all flags to clerk mcp install for non-interactive, scripted registration targeting specific or all supported clients.
Adds clerk mcp run, a built-in stdio↔Streamable-HTTP bridge that replaces the npx mcp-remote dependency; updating the CLI updates the bridge everywhere with no re-install.
Adds clerk mcp list to display every Clerk MCP entry registered across all clients, and clerk mcp uninstall to remove them selectively.
Extends clerk doctor to probe the configured Clerk MCP server with a real initialize handshake, distinguishing not installed, installed but unreachable, and working states.

+1 more show less

Supports configuring default OAuth scopes for dynamic client registration via the OAuth Applications settings in the Clerk Dashboard or the Backend API, preventing invalid_scope errors when clients omit the scope parameter.

6 details in Everything

└──▷ BREAKING ON UPGRADE

!Beginning January 18, 2027, CBC-mode SSL/TLS cipher suites (including TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, and others) will be removed from Clerk-managed subdomains (clerk.example.com, accounts.example.com); clients that can only negotiate a CBC cipher will fail the TLS handshake after their subdomain's certificate rotates.

docs update Jul 23, 2026 · issue 023

Clerk launches a remote MCP server giving AI agents like Claude, Cursor, and Copilot access to up-to-date SDK snippets and auth patterns.

└──▷ TRY IT

Register Clerk's MCP server in all detected AI clients on your machine in one step — no manual config editing required.

$ clerk mcp install --all

Wire Clerk's MCP server into a Claude Code session so it can answer auth questions with current SDK snippets.

$ claude mcp add clerk --transport http https://mcp.clerk.com/mcp

Manually add Clerk's MCP server to Cursor for projects where the CLI isn't available.

json

{
  "mcpServers": {
    "clerk": {
      "url": "https://mcp.clerk.com/mcp"
    }
  }
}

New remote Model Context Protocol (MCP) server at https://mcp.clerk.com/mcp lets AI coding agents access Clerk SDK snippets and implementation patterns.
New clerk mcp install CLI command auto-detects and registers the MCP server across Claude Code, Cursor, GitHub Copilot, Windsurf, Gemini CLI, Codex, opencode, OpenClaw, Warp, and Hermes Agent.
New clerk mcp list and clerk mcp uninstall commands manage registered MCP entries; clerk doctor verifies server reachability.
Exposes two MCP tools: clerk_sdk_snippet for fetching specific code patterns and list_clerk_sdk_snippets for browsing all available snippets and bundles.
Ships pre-built snippet bundles for B2B SaaS with Organizations/Billing, waitlist flows, auth basics, custom sign-in/sign-up flows, organization management, and server-side authentication patterns.

5 details in Everything

docs update Jul 23, 2026 · docs issue 004

Clerk launches a remote MCP server giving AI agents like Claude, Cursor, and Copilot access to up-to-date SDK snippets and auth patterns.

└──▷ TRY IT

Register Clerk's MCP server in all detected AI clients on your machine in one step — no manual config editing required.

$ clerk mcp install --all

Wire Clerk's MCP server into a Claude Code session so it can answer auth questions with current SDK snippets.

$ claude mcp add clerk --transport http https://mcp.clerk.com/mcp

Manually add Clerk's MCP server to Cursor for projects where the CLI isn't available.

json

{
  "mcpServers": {
    "clerk": {
      "url": "https://mcp.clerk.com/mcp"
    }
  }
}

New remote Model Context Protocol (MCP) server at https://mcp.clerk.com/mcp lets AI coding agents access Clerk SDK snippets and implementation patterns.
New clerk mcp install CLI command auto-detects and registers the MCP server across Claude Code, Cursor, GitHub Copilot, Windsurf, Gemini CLI, Codex, opencode, OpenClaw, Warp, and Hermes Agent.
New clerk mcp list and clerk mcp uninstall commands manage registered MCP entries; clerk doctor verifies server reachability.
Exposes two MCP tools: clerk_sdk_snippet for fetching specific code patterns and list_clerk_sdk_snippets for browsing all available snippets and bundles.
Ships pre-built snippet bundles for B2B SaaS with Organizations/Billing, waitlist flows, auth basics, custom sign-in/sign-up flows, organization management, and server-side authentication patterns.

5 details in Everything

docs update Jul 23, 2026 · issue 023

Clerk CLI gains clerk mcp commands to connect AI coding clients to Clerk's MCP server for live SDK snippets.

└──▷ TRY IT

Register Clerk's MCP server across all AI coding clients on your machine so they have access to current Clerk SDK snippets.

$ clerk mcp install

Verify which AI clients have the Clerk MCP server registered and confirm the server is reachable.

$ clerk mcp list && clerk doctor

New clerk mcp install command registers Clerk's MCP server with AI clients detected on the machine (Claude Code, Cursor, VS Code), serving up-to-date Clerk SDK snippets and implementation patterns.
New clerk mcp list command shows which AI clients have Clerk's MCP server registered.
New clerk mcp uninstall command removes Clerk's MCP server registration from detected AI clients.
MCP install runs non-interactively in agent mode, targets all detected clients by default, and reports per-client results as JSON.
clerk doctor now validates whether the configured Clerk MCP server is reachable as part of its integration checks.

5 details in Everything

docs update Jul 23, 2026 · docs issue 004

Clerk CLI gains clerk mcp commands to connect AI coding clients to Clerk's MCP server for live SDK snippets.

└──▷ TRY IT

Register Clerk's MCP server across all AI coding clients on your machine so they have access to current Clerk SDK snippets.

$ clerk mcp install

Verify which AI clients have the Clerk MCP server registered and confirm the server is reachable.

$ clerk mcp list && clerk doctor

New clerk mcp install command registers Clerk's MCP server with AI clients detected on the machine (Claude Code, Cursor, VS Code), serving up-to-date Clerk SDK snippets and implementation patterns.
New clerk mcp list command shows which AI clients have Clerk's MCP server registered.
New clerk mcp uninstall command removes Clerk's MCP server registration from detected AI clients.
MCP install runs non-interactively in agent mode, targets all detected clients by default, and reports per-client results as JSON.
clerk doctor now validates whether the configured Clerk MCP server is reachable as part of its integration checks.

5 details in Everything

Configurable default OAuth scopes (2026-07-22) Jul 22, 2026 · issue 023

Clerk lets you configure default OAuth scopes for dynamic client registration.

Connect your AI tools to Clerk MCP with one command (2026-07-22) Jul 22, 2026 · issue 023

Clerk MCP server now installs into 10 AI clients with a single command — no manual config required.

└──▷ TRY IT

Register the Clerk MCP server in all supported AI clients at once — no manual JSON or config editing needed.

$ clerk mcp install

New clerk mcp install command registers the Clerk MCP server across 10 AI clients (including Claude Code, Cursor, and VS Code) via a built-in bridge with zero manual configuration.

1 detail in Everything

Choose what SAML sends as a login hint (2026-07-15) Jul 15, 2026 · issue 017

Clerk SAML connections can now send an email address, custom attribute, or no login hint to your IdP.

Supports per-SAML-connection configuration of the login hint sent to identity providers: email address, a custom attribute, or none.

1 detail in Everything

CLI webhooks, impersonation, and a refreshed experience (2026-07-09) Jul 9, 2026 · issue 014

Clerk CLI 2.0 adds local webhook testing, one-command user impersonation, and a refreshed interactive UX.

New local webhooks toolkit lets you receive and inspect webhook events during development without a public URL.
New one-command user impersonation enables developers to instantly act as any user for debugging and testing.
Refreshed interactive CLI experience redesigned for both human developers and AI agents.

3 details in Everything

Disable just-in-time provisioning for SAML connections (2026-07-07) Jul 7, 2026 · issue 014

Clerk SAML connections now support disabling just-in-time provisioning to block unprovisioned users.

└──▷ TRY IT

Disable JIT provisioning on an existing SAML connection so only pre-provisioned users can sign in.

$ curl -X PATCH https://api.clerk.com/v1/saml_connections/<connection_id> \
  -H 'Authorization: Bearer <secret_key>' \
  -H 'Content-Type: application/json' \
  -d '{"disable_jit": true}'

Enable or disable JIT provisioning for a SAML connection through the Dashboard without touching the API.

📍In the Clerk Dashboard, go to Configure › SSO Connections › [your SAML connection] and toggle off Enable just-in-time provisioning.

Adds opt-in control to reject SAML sign-ins from users who lack an existing account, preventing automatic JIT provisioning.
Exposes a disable_jit field on the Backend API for programmatic control of JIT provisioning per SAML connection.
Adds a self-serve toggle in the Clerk Dashboard to enable or disable JIT provisioning on SAML connections.

3 details in Everything

Clerk Billing now supports account credits (2026-06-30) Jun 30, 2026 · issue 014

Clerk Billing adds account credit balance management via Dashboard and API.

Enables adjustment of customer credit balances directly from the Clerk Dashboard.
New API support for programmatically managing customer credit balances in Clerk Billing.

2 details in Everything

Self-serve SSO (2026-06-26) Jun 26, 2026 · issue 014

Clerk adds self-serve enterprise SSO configuration for IT admins via a new Security tab in OrganizationProfile.

└──▷ HOW TO FIND IT

Expose the new Security tab to organization members so their IT admins can self-configure enterprise SSO — no Clerk dashboard access required.

📍In the Clerk dashboard, ensure <OrganizationProfile /> is rendered in your app; IT admins will find the new Security tab there to configure and manage their enterprise SSO connections.

New Security tab in <OrganizationProfile /> lets customers' IT admins configure and manage their own enterprise SSO connections without involving your support team.

1 detail in Everything

Customize your OAuth consent page (2026-06-22) Jun 22, 2026 · issue 014

Clerk lets you host and customize the OAuth consent screen on your own domain via the <OAuthConsent /> component.

└──▷ USE IT

Render the OAuth consent screen on your own domain instead of Clerk's hosted page, keeping users in your brand experience.

jsx

<OAuthConsent />

Clerk

Summary

How Clerk helps

Languages

Features

What Clerk offers you

release

example

release

release 11 total

docs

example

docs

release 17 total

docs

example 7 total

release 15 total

docs 21 total

example

release 15 total

example

release

docs

example

release

release

example

docs

release

docs

release

docs

release

docs

release

example

release

docs

release

example

release

example

release

release

release

example

release

release

example

docs

release

docs

release

release

Command line

Screenshots

Score card

Trajectory

Release-note detail over time

Commercials

Plans by offering

Plan relaunches

Website history

Rebranding timeline

Coverage

Identity & access 3

Cloud platforms & services 1

Other 1

Operating systems 2

Other 2

Releases

Add the badge to your README