https://cybertoolchain.io/tools/clerk New releases and features in Clerk, tracked by The Cyber Toolchain. en Tue, 03 Nov 2026 00:00:00 GMT https://clerk.com/changelog/2026-11-03-directory-sync-updates https://clerk.com/changelog/2026-11-03-directory-sync-updates Tue, 03 Nov 2026 00:00:00 GMT Clerk adds group webhooks, group-read API endpoints, and directory pause to Directory Sync⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Clerk's Directory Sync now sends webhooks for group and membership changes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Clerk's Backend API now supports reading a group and its members via Directory Sync. • Pause a Directory Sync directory without removing any user access. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/changelog https://clerk.com/changelog Sun, 01 Nov 2026 07:48:00 GMT Clerk adds a Backend API logs endpoint, passkeys as a second MFA factor, agent feedback collection via MCP, and two new bulk sign-up protections⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Query audit logs programmatically with the `GET /v1/logs` Backend API endpoint, filtering on the same event types available in the Dashboard; requests over the rate limit return `too_many_requests`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Collect agent feedback through your MCP server by adding the `submit_feedback` tool from `@clerk/mcp-tools`, so agents can report friction — missing tools, unexpected errors, or blocked tasks — as they encounter it. • Allow passkeys to satisfy multi-factor authentication as a second factor: users who sign in with a password, social connection, or reset-password code can present a passkey instead of an SMS code or authenticator app, including during reverification; `supportedSecondFactors` can now include `passkey` in custom MFA flows. • Limit bulk account creation on the Business plan with two new Clerk Protect rules: 'Limit sign-ups per email domain' caps sign-ups from one domain per hour, and 'Limit sign-ups from shared infrastructure' caps bursts from the same infrastructure. • Clerk for Agent Auth, built on open OAuth standards and the Personal Agent Protocol, is now in private beta, enabling agents to discover your application and authenticate through Clerk. Breaking changes: • Test email addresses (`+clerk_test` subaddress) no longer receive any emails while Test mode is on — test suites that read sign-in links or invitation emails from a real inbox must switch those addresses to ones without `+clerk_test`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/changelog/2026-10-30-application-logs-backend-api https://clerk.com/changelog/2026-10-30-application-logs-backend-api Fri, 30 Oct 2026 00:00:00 GMT Clerk adds public access to the `GET /v1/logs` endpoint so application log events can be queried from code or AI agents⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Query application log events programmatically via the now-public `GET /v1/logs` Backend API endpoint, usable from custom code or an AI agent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/changelog/2026-10-29-passkey-second-factor https://clerk.com/changelog/2026-10-29-passkey-second-factor Thu, 29 Oct 2026 00:00:00 GMT Clerk adds passkeys as a second factor for multi-factor authentication⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Clerk now supports passkeys as a second factor, letting users verify with a passkey after signing in with another method.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/openapi.json https://clerk.com/openapi.json Mon, 26 Oct 2026 13:49:25 GMT API surface changed: +3 endpoints, 18 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint GET /directories/{directory_id}/groups/{group_id}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint GET /directories/{directory_id}/groups/{group_id}/members • New endpoint POST /users/{user_id}/merge Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/changelog/2026-10-23-agent-feedback https://clerk.com/changelog/2026-10-23-agent-feedback Fri, 23 Oct 2026 00:00:00 GMT Clerk adds agent feedback collection via MCP server, reviewable in the Clerk dashboard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Enables AI agents to submit product feedback directly from an MCP server, with submissions reviewable in the Clerk dashboard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/changelog/2026-10-23-merge-users https://clerk.com/changelog/2026-10-23-merge-users Fri, 23 Oct 2026 00:00:00 GMT Clerk adds a Backend API endpoint to merge a duplicate user into another and delete the duplicate.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a Backend API endpoint to merge a duplicate user into another user and delete the duplicate.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/changelog https://clerk.com/changelog Thu, 22 Oct 2026 07:50:49 GMT Clerk MCP server gains account access, native Expo components split into a separate package, and Dashboard masks Secret keys after creation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Splits Clerk's native Expo components (`<AuthView />`, `<UserButton />`, `<UserProfileView />`) into a dedicated `@clerk/expo-native-components` package, imported from `@clerk/expo/native-components`, so apps not using native components no longer bundle the iOS and Android SDKs — available in `@clerk/expo` 4.11.0.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Connects the Clerk MCP server to your Clerk account, enabling agents to create applications, configure authentication, manage users, and set up production instances via your MCP client's sign-in flow. • Updates the `API keys` page in the Clerk Dashboard to reveal a Secret key's full value only at creation time, showing only a partial value thereafter to reduce the risk of key leakage. Breaking changes: • The `@clerk/expo/native` import path is deprecated and will be removed in the next major version; update imports to `@clerk/expo/native-components` after installing `@clerk/expo-native-components`. • On Android, apps without `@clerk/expo-native-components` no longer migrate biometric credentials enrolled with earlier SDK versions — affected users must re-enroll. The new app binary must be shipped before any over-the-air update that includes this change, or native components will throw a runtime error. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/changelog/2026-10-15-revamped-clerk-mcp-server https://clerk.com/changelog/2026-10-15-revamped-clerk-mcp-server Thu, 15 Oct 2026 00:00:00 GMT Clerk launches a revamped MCP server for managing applications, users, and configuration directly from an AI agent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New Clerk MCP server enables managing Clerk applications, users, configuration, and production setup directly from an AI agent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/changelog https://clerk.com/changelog Mon, 05 Oct 2026 07:56:16 GMT Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/changelog https://clerk.com/changelog Sun, 04 Oct 2026 07:49:42 GMT Clerk adds self-serve Directory Sync inside <OrganizationProfile /> and SSO bypass allowlists for enterprise connections.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `org:sys_entconns:manage` permission-gated self-serve Directory Sync wizard inside the `<OrganizationProfile />` Security tab, supporting Okta Workforce, Microsoft Entra ID, Google Workspace, and custom SAML/OIDC connections — admins get a generated SCIM endpoint URL and bearer token without needing Clerk Dashboard access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `sign_in.sso_bypass.succeeded` audit event logged each time a user on an SSO bypass allowlist signs in via one-time email code instead of through the IdP. • Adds `org:sys_entconns_sso_bypass:manage` system permission, included in the default Admin role, allowing Organization members to manage their SSO bypass allowlist from `<OrganizationProfile />`. • Enables the `Allow this organization to set up enterprise SSO and Directory Sync` toggle under Organization permissions in the Clerk Dashboard to expose the self-serve Directory Sync section wherever `<OrganizationProfile />` or `<OrganizationSwitcher />` renders. • Adds SSO bypass, letting a per-connection allowlist of users sign in with a one-time email code when an enterprise SSO connection is broken or unavailable, surfacing a 'Can't use SSO?' link in `<SignIn />`. • Supports pausing, resuming, or removing a self-serve Directory Sync connection from within `<OrganizationProfile />` after initial setup. • Supports Google Workspace Directory Sync via Google Admin SDK by uploading a service account key and a Workspace admin email address inside the self-serve wizard. • Retains Dashboard-side controls for custom attribute mapping and role mapping (off by default) for self-serve directories alongside dashboard-managed directories. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/openapi.json https://clerk.com/openapi.json Sat, 03 Oct 2026 13:02:45 GMT API surface changed: +4 endpoints, 11 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint DELETE /invitations/{invitation_id}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint DELETE /sso_bypass_allowlist_users/{userID} • New endpoint GET /sso_bypass_allowlist_users • New endpoint POST /sso_bypass_allowlist_users Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/changelog/2026-09-30-self-serve-directory-sync https://clerk.com/changelog/2026-09-30-self-serve-directory-sync Wed, 30 Sep 2026 00:00:00 GMT Clerk lets end-customer IT admins self-serve Directory Sync setup (including Google Workspace) via <OrganizationProfile />⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Enables IT admins to self-configure Directory Sync — including Google Workspace — directly from the Security tab inside the `<OrganizationProfile />` component, without requiring developer intervention.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/changelog/2026-09-29-sso-bypass https://clerk.com/changelog/2026-09-29-sso-bypass Tue, 29 Sep 2026 00:00:00 GMT Clerk lets specific users bypass enterprise SSO and sign in with an email code when their SSO connection is unavailable.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Allows specific users to sign in with an email code when their enterprise SSO connection is unavailable.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/changelog https://clerk.com/changelog Sat, 26 Sep 2026 12:45:56 GMT Clerk: Enables `Publish CIMD support` toggle under `Client onboarding` in OAuth application settings, letting MCP and other public OAuth clients authenticate via HTTPS URL as `client_id` without a pre-issued secret or Dynamic Client Registration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `Client admission` control to OAuth application settings, with a `Pre-registered clients only` mode to restrict flows to reviewed clients. • Introduces SMS delivery events (`sms.accepted`, `sms.delivered`, `sms.failed`, `sms.undeliverable`, `sms.unconfirmed`) with a normalized `reason` field (e.g. `invalid_phone_number`, `destination_unreachable`, `rate_limited`) logged in a dedicated SMS logs view for all plans. • Allows Organizations to have more than one SAML or OIDC enterprise connection simultaneously, removing the previous `organization_already_has_sso_connection` limit, across the Clerk Dashboard and Backend API. • Enables a single Organization to receive Directory Sync feeds from multiple directories, with per-directory membership and deprovisioning tracked independently. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/changelog https://clerk.com/changelog Fri, 25 Sep 2026 13:13:25 GMT Clerk adds multi-IdP enterprise SSO per Organization, GA Client ID Metadata Documents, and SMS delivery event logs⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Enables `Publish CIMD support` toggle in the `OAuth applications settings` page under `Client onboarding`, with a `Client admission` control (`Pre-registered clients only`) and per-client scope management via the `Applications` tab — making Client ID Metadata Documents generally available for all applications.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds SMS delivery event logging with five normalized event types — `sms.accepted`, `sms.delivered`, `sms.failed`, `sms.undeliverable`, and `sms.unconfirmed` — each carrying a `reason` field (e.g. `invalid_phone_number`, `destination_unreachable`, `rate_limited`) and full trace linking across a message's lifecycle. • Adds a dedicated `SMS logs view` filterable by event type (e.g. `sms.failed`) or destination phone number, available on all plans as part of Application Logs. • Removes the one-enterprise-connection-per-Organization limit across the Clerk Dashboard and Backend API, allowing multiple SAML or OIDC connections — each with its own domain, protocol, and Directory Sync — on a single Organization. • Supports multi-directory membership resolution: a user's active status and Organization membership are recalculated across all enabled directories, with deactivation or membership removal triggered only when every managing directory has deprovisioned them. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/changelog https://clerk.com/changelog Thu, 24 Sep 2026 07:52:22 GMT Clerk: Enables `Publish CIMD support` in OAuth application settings so MCP and other public OAuth clients can identify themselves via an HTTPS URL as their `client_id`, without a pre-issued client secret or Dynamic Client Registration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds an `SMS logs view` in Application Logs with five delivery event types — `sms.accepted`, `sms.delivered`, `sms.failed`, `sms.undeliverable`, and `sms.unconfirmed` — for phone verification codes, OTPs, and password reset codes. • Groups all events for a single SMS message under a shared trace, enabling end-to-end timeline reconstruction for a single recipient. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/changelog/2026-09-24-multiple-enterprise-connections-per-organization https://clerk.com/changelog/2026-09-24-multiple-enterprise-connections-per-organization Thu, 24 Sep 2026 00:00:00 GMT Clerk Organizations can now link multiple SAML or OIDC enterprise connections, enabling multi-directory user provisioning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports linking multiple SAML or OIDC enterprise connections to a single Organization, allowing more than one directory to provision the same user.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/changelog https://clerk.com/changelog Wed, 23 Sep 2026 07:43:58 GMT Clerk: Adds SMS delivery event logging with five typed events — `sms.accepted`, `sms.delivered`, `sms.failed`, `sms.undeliverable`, and `sms.unconfirmed` — available in the `SMS logs view` under Application Logs on all plans. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/changelog https://clerk.com/changelog Tue, 22 Sep 2026 12:59:51 GMT Clerk adds Client ID Metadata Documents (GA) and SMS delivery event logs with per-event failure reasons⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `sms.accepted`, `sms.delivered`, `sms.failed`, `sms.undeliverable`, and `sms.unconfirmed` SMS delivery events to Application Logs, with a normalized `reason` field (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ `invalid_phone_number`, `destination_unreachable`, `rate_limited`) on failure events. • Adds a dedicated SMS logs view that lets you filter SMS delivery events by event type (e.g. `sms.failed`) or destination phone number, with full per-message trace timelines. • Adds `Client admission` control to CIMD settings, allowing operators to restrict OAuth flows to pre-reviewed clients by setting `Client admission` to `Pre-registered clients only`. • Adds `Publish CIMD support` toggle to the OAuth applications settings page under `Client onboarding`, enabling CIMD in the authorization server metadata. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/openapi.json https://clerk.com/openapi.json Mon, 21 Sep 2026 14:36:27 GMT API surface changed: +1 endpoint, 2 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint GET /sessions/{session_id}/reverifications/{reverification_id}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/changelog/2026-09-17-client-id-metadata-documents-ga https://clerk.com/changelog/2026-09-17-client-id-metadata-documents-ga Mon, 21 Sep 2026 00:00:00 GMT Client ID Metadata Documents (CIMD) are now generally available for all Clerk applications, enabling URL-based OAuth client identity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Makes Client ID Metadata Documents (CIMD) generally available for every Clerk application, allowing MCP and other public OAuth clients to connect with a URL-based identity without requiring a support request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/changelog/2026-09-17-sms-logs https://clerk.com/changelog/2026-09-17-sms-logs Thu, 17 Sep 2026 00:00:00 GMT Clerk Application Logs now expose the full delivery lifecycle of every SMS message sent through Clerk.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds SMS delivery lifecycle tracking to Application Logs, letting teams trace the status of every Clerk-delivered SMS.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/openapi.json https://clerk.com/openapi.json Mon, 14 Sep 2026 14:39:02 GMT Breaking changes: • Deprecated endpoint DELETE /users/{user_id}/trusted_devices/{trusted_device_id} (still works) • Deprecated endpoint GET /users/{user_id}/trusted_devices (still works) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/openapi.json https://clerk.com/openapi.json Sun, 13 Sep 2026 14:47:50 GMT API surface changed: +2 endpoints, 9 modified, 2 deprecated⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint DELETE /users/{user_id}/biometric_credentials/{biometric_credential_id}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint GET /users/{user_id}/biometric_credentials Breaking changes: • Deprecated endpoint DELETE /users/{user_id}/trusted_devices/{trusted_device_id} (still works) • Deprecated endpoint GET /users/{user_id}/trusted_devices (still works) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/changelog https://clerk.com/changelog Sun, 13 Sep 2026 07:42:33 GMT Clerk: Adds OAuth 2.0 Device Authorization Grant (beta, RFC 8628) for applications that cannot open a browser or accept text input — CLIs, TVs, game consoles — letting users approve access from a separate browser-capable device.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports both public clients (Client ID only) and confidential clients (Client ID + Client Secret) for device authorization flows. • Automatically advertises `device_authorization_endpoint` and `urn:ietf:params:oauth:grant-type:device_code` in OAuth 2.0 and OpenID Connect metadata when Device Authorization Grant is available and the verification page is reachable. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/openapi.json https://clerk.com/openapi.json Sat, 12 Sep 2026 13:29:07 GMT Breaking changes: • Deprecated endpoint DELETE /users/{user_id}/trusted_devices/{trusted_device_id} (still works) • Deprecated endpoint GET /users/{user_id}/trusted_devices (still works) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/changelog https://clerk.com/changelog Sat, 12 Sep 2026 07:43:16 GMT Clerk adds OAuth 2.0 Device Authorization Grant (beta) for CLIs, TVs, and input-constrained devices.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds support for `device_authorization_endpoint` and grant type `urn:ietf:params:oauth:grant-type:device_code` advertised automatically via OAuth 2.0 and OpenID Connect metadata when Device Authorization Grant is enabled.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Clerk's Account Portal hosts user verification for device flows, displaying the OAuth application, requested scopes, optional Organization selection, and approve/deny actions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/openapi.json https://clerk.com/openapi.json Fri, 11 Sep 2026 14:46:29 GMT Breaking changes: • Deprecated endpoint DELETE /users/{user_id}/trusted_devices/{trusted_device_id} (still works) • Deprecated endpoint GET /users/{user_id}/trusted_devices (still works) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/changelog https://clerk.com/changelog Fri, 11 Sep 2026 07:38:44 GMT Clerk adds device authorization metadata so OAuth clients can discover the enabled grant automatically. • Adds OAuth 2.0 Device Authorization Grant (RFC 8628) beta support, letting CLIs, TVs, game consoles, and other browserless devices obtain tokens by having a user approve access on a separate browser-capable device. • Device Authorization Grant shares Clerk OAuth scopes, tokens, consent context, and Organization claims with the Authorization Code Flow; PKCE and redirect URIs are not used. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/openapi.json https://clerk.com/openapi.json Thu, 10 Sep 2026 14:46:46 GMT API surface changed: +2 endpoints, 9 modified, 2 deprecated⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint DELETE /users/{user_id}/biometric_credentials/{biometric_credential_id}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint GET /users/{user_id}/biometric_credentials Breaking changes: • Deprecated endpoint DELETE /users/{user_id}/trusted_devices/{trusted_device_id} (still works) • Deprecated endpoint GET /users/{user_id}/trusted_devices (still works) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/changelog https://clerk.com/changelog Thu, 10 Sep 2026 07:40:52 GMT Clerk: Adds OAuth 2.0 Device Authorization Grant (beta, RFC 8628) for clients that cannot open a browser — CLIs, TVs, game consoles — enabling device-code polling flows without redirect URIs or PKCE.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports both public clients (Client ID only) and confidential clients (Client ID + Client Secret) in the Device Authorization Grant flow. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/changelog https://clerk.com/changelog Wed, 09 Sep 2026 10:37:37 GMT Clerk: Supports both public clients (Client ID only) and confidential clients (Client ID + Client Secret) in the device flow. • Clerk's Account Portal serves as the hosted verification page, presenting the OAuth application name, requested scopes, Organization selection, and approve/deny actions to the authorizing user. • Automatically advertises `device_authorization_endpoint` and grant type `urn:ietf:params:oauth:grant-type:device_code` via OAuth 2.0 and OpenID Connect metadata discovery when Device Authorization Grant is enabled and the verification page is reachable. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/changelog/2026-09-08-device-authorization-grant https://clerk.com/changelog/2026-09-08-device-authorization-grant Tue, 08 Sep 2026 00:00:00 GMT Clerk adds OAuth Device Authorization Grant support for CLIs, TVs, and input-constrained devices. • Adds OAuth Device Authorization Grant flow to authenticate CLIs, smart TVs, and other input-constrained devices using a standards-based OAuth flow. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/changelog https://clerk.com/changelog Wed, 02 Sep 2026 00:00:29 GMT Clerk adds a 1–10 minute Reverification window in Dashboard Sessions, limiting how long sensitive-action reverification remains valid. • Adds `Admin Logs` to the Clerk Dashboard: a reverse-chronological audit trail of configuration changes made via the Dashboard, Backend API, or Platform API, with filters for `Event type` (supports trailing wildcards, e.g. `oauth_application.*`), `Instance`, `Application`, `Actor`, `IP address`, and `Time range`; available on Business and Enterprise plans. • Adds biometric credential APIs to Clerk's mobile SDKs — `useBiometricCredentials` (React Native/Expo), `Clerk.shared.biometricCredentials.signInWithBiometrics` and `Clerk.shared.biometricCredentials.biometricCredentialId` (Swift), and `Clerk.biometricCredentials.signInWithBiometrics` and `Clerk.biometricCredentials.biometricCredentialId` (Android) — enabling enrollment and sign-in via Face ID, Touch ID, or Android biometrics with a device-bound private key. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/changelog https://clerk.com/changelog Tue, 01 Sep 2026 15:14:31 GMT Clerk adds Admin Logs audit trail, configurable reverification window, and biometric credential enrollment for mobile SDKs • New `Reverification window` setting on the `Sessions` page in the Clerk Dashboard lets you configure how long a successful reverification remains valid, from 1 to 10 minutes (default: 10 minutes), controlling how frequently users must re-authenticate before sensitive actions such as changing a password, adding/removing an email address, revoking a session, or deleting an account. • New `Admin Logs` section in the Clerk Dashboard provides a reverse-chronological audit trail of configuration changes made via the Dashboard, Backend API, or Platform API — tracking events such as creating OAuth applications, updating instance settings, rotating secrets, and managing Roles and Permissions. • Admin Logs support filtering by `Event type` (with trailing wildcard support, e.g. `oauth_application.*`), `Instance`, `Application`, `Actor`, `IP address`, and `Time range`; available on Business and Enterprise plans, recording from August 24, 2026 onward. • Clerk mobile SDKs now support biometric credential enrollment and sign-in (Face ID, Touch ID, Android biometrics) via `useBiometricCredentials` (React Native), `Clerk.shared.biometricCredentials.signInWithBiometrics` and `Clerk.shared.biometricCredentials.biometricCredentialId` (Swift), and `Clerk.biometricCredentials.signInWithBiometrics` and `Clerk.biometricCredentials.biometricCredentialId` (Android), with the private key remaining device-bound. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/changelog/2026-08-28-customize-reverification-window https://clerk.com/changelog/2026-08-28-customize-reverification-window Fri, 28 Aug 2026 00:00:00 GMT Clerk lets you control how recently users must have authenticated before they can perform sensitive actions. • Adds the ability to customize the reverification window, defining how recently a user must have authenticated before sensitive actions are permitted. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/changelog https://clerk.com/changelog Tue, 25 Aug 2026 13:22:05 GMT Clerk adds custom OAuth scopes for MCP clients and biometric trusted-device sign-in for mobile SDKs • Adds custom OAuth scope definitions in the Clerk Dashboard (examples: `messages:read`, `tools:execute`, `resources/files:read`, `mcp_all`) so MCP clients can request only the access each OAuth application needs. • Adds OAuth metadata advertisement control so MCP clients can discover which scopes your application supports via Clerk's OAuth metadata endpoint. • Adds `useTrustedDevices` hook in `@clerk/expo` with `enroll`, `signIn`, and `revoke` methods to register a device and authenticate returning users with Face ID, Touch ID, or Android biometrics. • Adds `Clerk.shared.trustedDevices.enroll`, `Clerk.shared.auth.signInWithTrustedDevice`, and Clerk.shared.trustedDevices.revoke(id: trustedDeviceId) APIs for iOS trusted-device biometric sign-in. • Adds `Clerk.trustedDevices.enroll`, `signInWithTrustedDevice`, and Clerk.trustedDevices.revoke(trustedDeviceId) APIs for Android trusted-device biometric sign-in. • Prebuilt auth and user profile views now surface a biometric enrollment prompt, biometric sign-in button, and current-device toggle without custom code. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/changelog/2026-08-25-admin-logs https://clerk.com/changelog/2026-08-25-admin-logs Tue, 25 Aug 2026 00:00:00 GMT Clerk adds Admin Logs to give teams an audit trail of admin actions across their workspace. • New Admin Logs dashboard provides an audit trail of admin actions taken across a Clerk workspace. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/changelog/2026-08-21-custom-oauth-scopes https://clerk.com/changelog/2026-08-21-custom-oauth-scopes Fri, 21 Aug 2026 00:00:00 GMT Clerk adds custom OAuth scopes for precise, discoverable MCP client access control. • Supports custom OAuth scopes, enabling precise and discoverable access control for MCP clients connecting to your API. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/changelog https://clerk.com/changelog Tue, 18 Aug 2026 09:06:00 GMT Clerk Billing adds discounts and promo codes — apply percentage or fixed-amount deals to subscriptions or share redeemable codes at checkout. • Adds discount support to Clerk Billing: create reusable percentage or fixed-amount discounts and apply them manually to any active subscriber's subscription from the Dashboard, with the ability to revoke at any time. • Adds promo codes (e.g. `LAUNCH20`) that customers can enter at checkout to self-redeem discounts, with optional redemption caps, new-subscriber restrictions, and per-code usage tracking. • Supports per-period discount amounts, letting you set different discount values for monthly and annual billing cycles. • Supports discount durations of a single billing cycle, a set number of cycles, or indefinitely. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/changelog/2026-08-17-biometric-sign-in-mobile-sdks https://clerk.com/changelog/2026-08-17-biometric-sign-in-mobile-sdks Mon, 17 Aug 2026 00:00:00 GMT Clerk adds biometric sign-in for returning users on Expo, iOS, and Android. • Enables biometric sign-in (device-trusted prompt) for returning mobile users on Expo, iOS, and Android. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/changelog https://clerk.com/changelog Mon, 10 Aug 2026 09:55:07 GMT Clerk adds CIMD beta for OAuth clients, Google Workspace Directory Sync, and strict enumeration protection for combined sign-in-or-up flows. • Adds `organizations.title` and `customSchemas.<schema>.<field>` (e.g., `customSchemas.EmployeeInfo.costCenter`) as mappable custom attribute paths in Google Workspace Directory Sync, including array paths for multi-valued attributes. • Adds `signUpIfMissing` option for custom sign-in flows to enable sign-in-or-up behavior without enabling strict enumeration protection globally. • Adds `sign_up_if_missing_password_preferred` console warning on development instances when `<SignIn />` detects an incompatible strict-protection + password configuration. • New CIMD (Client ID Metadata Document) beta lets OAuth clients use an HTTPS URL as their `client_id` — Clerk fetches and validates the metadata document, eliminating the need for pre-issued client IDs, secrets, or Dynamic Client Registration; aimed at MCP and other public OAuth clients. • New 'CIMD Clients' tab on the OAuth provider page lets admins explicitly allow clients by Client ID URL, assign scopes, review admission status and metadata fetch health, refresh metadata, and block or delete saved clients. • New 'Advertise CIMD support' toggle publishes CIMD in authorization server metadata, allowing any compatible client to connect; pairs with 'Only allow pre-registered clients to connect' to restrict OAuth flows to pre-reviewed clients. • Directory Sync now supports Google Workspace: Clerk syncs users, groups, and group memberships via a Google service account with domain-wide delegation, without requiring sign-in events to trigger updates. • Google Workspace Directory Sync is configured in the Dashboard under a Google SAML connection's 'Directory sync' tab by uploading a service account key and specifying the admin to impersonate. • Google groups synced via Directory Sync can be mapped to Clerk Roles. • `<SignIn />` now supports strict user enumeration protection and sign-in-or-up together out-of-the-box, with no code changes required — verification occurs before Clerk decides whether to sign in or create an account. • Strict enumeration protection is enabled on the Dashboard's Rules page under Protect; existing apps using `<SignIn />` as a combined sign-in-or-up page with public sign-ups continue working with no migration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/changelog/2026-08-10-discounts-and-promo-codes https://clerk.com/changelog/2026-08-10-discounts-and-promo-codes Mon, 10 Aug 2026 00:00:00 GMT Clerk Billing gains percentage and fixed-amount discounts plus redeemable promo codes at checkout. • Adds support for applying percentage or fixed-amount discounts directly to a customer's subscription in Clerk Billing. • Adds promo codes that customers can redeem at checkout. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/changelog/2026-08-05-google-workspace-directory-sync https://clerk.com/changelog/2026-08-05-google-workspace-directory-sync Wed, 05 Aug 2026 00:00:00 GMT Clerk adds Google Workspace Directory Sync with role mapping and custom attribute support. • Adds Google Workspace Directory Sync to sync users and groups directly from Google Workspace into Clerk, with support for role mapping and custom attributes. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/changelog/2026-08-04-sign-in-or-up-strict-enumeration https://clerk.com/changelog/2026-08-04-sign-in-or-up-strict-enumeration Tue, 04 Aug 2026 00:00:00 GMT Clerk's <SignIn /> component now supports the combined sign-in-or-up flow under strict user enumeration protection. • Enables the combined sign-in-or-up flow in `<SignIn />` when strict user enumeration protection is active — visitors verify identity first, then Clerk signs them in or creates the account. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/changelog https://clerk.com/changelog Sun, 02 Aug 2026 10:19:14 GMT Clerk adds self-serve OIDC SSO for org admins, hosted mobile auth, and composable profile UI building blocks. • Adds OIDC provider support to Self-serve SSO, letting customers' IT admins configure custom OpenID Connect connections directly inside `<OrganizationProfile />` without Dashboard access — domains are verified via DNS TXT record and the connection is scoped to the Organization. • New startHostedAuth() method in Expo, iOS, and Android SDKs hands the full sign-in/sign-up flow to Account Portal in a browser session, automatically covering all enabled auth methods (email codes, passwords, social, enterprise SSO, MFA) without requiring native UI. • Introduces experimental composable building blocks in `@clerk/ui/experimental` for assembling `<UserProfile />` and `<OrganizationProfile />` from individual panels and sections (e.g. `UserProfileAccountPanel`, `UserProfileEmailSection`, `OrganizationProfileMembersPanel`). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/changelog/2026-07-30-self-serve-sso-oidc https://clerk.com/changelog/2026-07-30-self-serve-sso-oidc Fri, 31 Jul 2026 00:00:00 GMT Clerk lets end-customer IT admins self-configure OIDC SSO connections directly from the OrganizationProfile UI. • Enables organization IT admins to configure their own OpenID Connect SSO connections self-serve via the Security tab in <OrganizationProfile />. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/changelog/2026-07-28-mobile-hosted-auth https://clerk.com/changelog/2026-07-28-mobile-hosted-auth Tue, 28 Jul 2026 00:00:00 GMT Clerk now supports hosted authentication via Account Portal for Expo, iOS, and Android apps. • Enables browser-based sign-in and sign-up flows through Clerk's Account Portal for mobile apps built with Expo, iOS, and Android. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk https://clerk.com/changelog/2026-07-27-composable-profile-components https://clerk.com/changelog/2026-07-27-composable-profile-components Mon, 27 Jul 2026 00:00:00 GMT Clerk introduces composable, experimental building-block APIs for UserProfile and OrganizationProfile pages. • New experimental composable API lets developers build custom UserProfile and OrganizationProfile pages from Clerk's individual UI building blocks instead of using the pre-built monolithic components. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clerk