Clerk Documentation
repository·main·Indexed 41 days ago
https://github.com/clerk/clerk-docsDocumentation for Clerk's authentication and user management platform, featuring guides on the Backend API, user creation via createUser(), password hash migration, and custom authentication flows for Next.js, Expo, iOS (Swift), and Android (Kotlin).
What's inside Clerk
- The Clerk React Router SDK provides prebuilt components, React hooks, and helpers designed to simplify user authentication within React Router applications. It is built on top of the Clerk React SDK, allowing you to leverage standard React hooks for managing authentication state.
Overview of Enterprise Single Sign-On (SSO)
mainClerk Enterprise SSO allows users to authenticate using credentials from federated identity providers (IdPs) like Azure AD, Okta, or Google Workspace. Clerk synchronizes this user data with your application.
Supported protocols:
- SAML: Best for single-tenant IdP requirements. Supports Microsoft Azure AD, Google Workspace, Okta Workforce, and custom SAML providers.
- OIDC: Supported via EASIE or custom OIDC-compatible providers.
Key Concepts:
- Account Linking: Existing users with email addresses matching the SSO domain will have an Enterprise account linked to their existing Clerk account upon their next sign-in.
- Multi-factor Authentication (MFA): If MFA is enabled in Clerk, users must complete Clerk's additional authentication factors after returning from the IdP.
- Deletion: Deleting an Enterprise Connection does not delete users; it simply removes that specific sign-in method, requiring users to use other methods (like password or email codes).
Overview of Clerk Account Portal
mainThe Account Portal provides hosted authentication and profile management pages, eliminating the need to build or host your own sign-in, sign-up, or profile management UIs.
- Web Applications: Can link directly to the hosted Account Portal pages.
- Native Applications (Expo, iOS, Android): Can open the Account Portal in a browser authentication session, which the Clerk SDK then activates within the native app.
When to use Account Portal vs. other options:
- Use Account Portal if you want the fastest way to add authentication with minimal setup.
- Use Prebuilt Components if you need more precise UI customization within your own application.
- Use Custom UI (Clerk API) if you want to build a completely custom user interface from scratch.
Overview of the Clerk Expo SDK
mainThe Clerk Expo SDK provides prebuilt components, React hooks, and helpers to simplify user authentication in Expo applications. It supports native authentication flows, hosted authentication via Account Portal, and provides specialized hooks for Expo environments including biometric sign-in and local credential storage.
For a step-by-step setup, refer to the quickstart guide.
Explore Clerk features
mainClerk provides several core features to handle identity and access management:
- Authentication: Implement various authentication strategies tailored to your users.
- User management: Quickly add sign-up, sign-in, and profile management to your application.
- Organizations: Manage shared accounts for teams and projects, allowing members with elevated privileges to control access to data and resources.
- Billing: Set up B2C and B2B billing, including subscription plans, free trials, payments, and webhook events.
- Waitlist: Use an integrated workflow to collect signups and control access to features before a product launch.
Configure supported social providers (OAuth)
mainClerk supports a wide range of social providers for user sign-up and sign-in via OAuth. To configure a specific provider, you must navigate to its dedicated configuration guide.
If your required provider is not listed, you can:
- Configure a custom OIDC-compatible provider if it supports the OpenID Connect protocol.
- Request a new provider via the Clerk feedback roadmap.
Commonly supported providers include Apple, Google, GitHub, Microsoft, Discord, Slack, and many others.
Explore Clerk native mobile features
mainClerk's native mobile SDKs provide capabilities for several core identity management areas:
- Authentication flows: Handles sign-in, sign-up, and session management.
- User management: Provides tools to manage the currently signed-in user.
- Organization management: Allows managing members, invitations, and organization settings.
Use M2M tokens for machine-to-machine authentication
mainClerk's Machine-to-Machine (M2M) tokens allow you to authenticate requests between different backend services within your own infrastructure. You create 'machines', define which machines are allowed to communicate with each other (scopes), and generate tokens that represent these permissions.
Key Concepts
- Machines: Represent your backend services. Each machine has a unique
machine secret key. - Scopes: Define which machines a specific machine is allowed to communicate with.
- Token Formats:
- Opaque tokens (default): Stored by Clerk. They can be revoked, but require a network request for verification (incurring verification costs).
- JWTs: Do not require a network request for verification and only incur creation costs, but they cannot be revoked.
Pricing
- Creation:
$0.001per token (first 2,500/month free). - Verification:
$0.00001per verification (first 100,000/month free). - Note: Hobby plan users are limited to the free tier.
- Machines: Represent your backend services. Each machine has a unique
Use the `<SignIn />` component
mainThe
<SignIn />component renders a UI that allows users to sign in or sign up. Its behavior (available auth strategies and social connections) is primarily controlled via the Clerk Dashboard. The component also automatically handles required session tasks after a user signs in.Note: If a user is already signed in and your application only allows a single session, the
<SignIn />and<SignUp />components will not render; instead, Clerk will redirect the user to the Home URL.Use Expo Native Components for iOS and Android
mainThe Clerk Expo SDK provides prebuilt native UI components rendered with SwiftUI on iOS and Jetpack Compose on Android. These components provide a fully native authentication experience for Expo apps.
Available Components
<AuthView />: Renders authentication flows inline in your React Native view hierarchy.<UserProfileView />: Renders user management UI inline.<UserButton />: Renders the platform-native Clerk button and opens<UserProfileView />when tapped.
IMPORTANT These native components are for the iOS and Android surfaces. For Expo web, use Clerk's standard UI components.
import { AuthView } from '@clerk/expo/native' // Example usage in a Modal <AuthView onDismiss={() => setIsAuthOpen(false)} />Advanced Clerk concepts and integrations
mainBeyond basic authentication, Clerk offers tools for advanced application development:
- Securing your application: Implement access control, authorization checks, session options, MFA, password policies, bot protection, and compliance tools.
- Database integrations: Enable Clerk-managed users to authenticate and interact directly with your database.
- Development tools: Manage environment variables, custom auth flows, third-party integrations, testing, and deployment.
- Clerk Dashboard: A central interface to configure your instance, manage settings, and monitor usage.
- SDK Reference: Documentation for calling the Clerk server API via official SDKs.
- How Clerk works: Deep dives into authentication protocols, token management, and security practices.
What is Directory Sync and how does it work?
mainDirectory Sync automatically provisions and deprovisions users in your Clerk application by connecting to your organization's identity provider (IdP). Unlike Just-in-Time (JIT) provisioning, which creates users only upon their first sign-in, Directory Sync proactively syncs the user base. This ensures users are created before they sign in and are deactivated immediately when removed from the IdP, which is critical for prompt deprovisioning (e.g., when an employee leaves).
Key Operations:
- Create: When a user is provisioned in the IdP, Clerk creates the account and fires a
user.createdwebhook. - Update: Changes to attributes (name, email, custom attributes) in the IdP are synced to Clerk, firing a
user.updatedwebhook. - Delete / Disable: When a user is removed or deactivated in the IdP, Clerk deactivates the user and revokes all active sessions, firing a
user.updatedwebhook.
Requirements:
- You must have an existing SAML or OIDC enterprise connection set up before enabling Directory Sync.
- Directory Sync requires an enterprise connection, which is available on Pro or Business plans.
- Create: When a user is provisioned in the IdP, Clerk creates the account and fires a