clerk-authClerk auth with API Keys beta (Dec 2025), Next.js 16 proxy.ts (March 2025 CVE context), API version 2025-11-10 breaking changes, clerkMiddleware() options, webhooks, production considerations (GCP outages), and component reference. Prevents 15 documented errors. Use when: API keys for users/orgs, Next.js 16 middleware filename, troubleshooting JWKS/CSRF/JWT/token-type-mismatch errors, webhook verification, user type inconsistencies, or testing with 424242 OTP.
Install via ClawdBot CLI:
clawdbot install veeramanikandanr48/clerk-authGrade Fair — based on market validation, documentation quality, package completeness, maintenance status, and authenticity signals.
Sends data to undocumented external endpoint (potential exfiltration)
Post → https://clerk.com/blog/postmortem-jun-26-2025-service-outageCalls external URL not in known-safe list
https://yourdomain.comAI Analysis
The skill provides legitimate Clerk authentication guidance and code examples. The external URLs referenced (clerk.com, yourdomain.com) are for documentation, API calls, and authorized webhook endpoints consistent with the skill's stated purpose. No credential harvesting, data exfiltration, or hidden malicious instructions are present.
Audited Apr 17, 2026 · audit v1.0
Generated Mar 21, 2026
A B2B SaaS platform needs to provide API keys for users and organizations to enable programmatic access to their services. This skill helps implement secure API key generation, management, and verification, ensuring proper token-type handling and preventing unauthorized access. It supports user-scoped and org-scoped keys with built-in UI components for self-service management.
An e-commerce site uses Clerk for user authentication and must integrate with billing APIs for subscription management. This skill addresses breaking changes in API version 2025-11-10, such as endpoint updates from /commerce/ to /billing/, ensuring smooth migration and preventing errors in payment processing. It also handles webhook verification for transaction events.
A company upgrading to Next.js 16 needs to secure their authentication middleware against vulnerabilities like the March 2025 CVE that allowed bypass via HTTP headers. This skill guides renaming middleware.ts to proxy.ts and implementing clerkMiddleware with proper matchers, preventing authorization bypass and ensuring compliance with latest security practices.
A mobile application requires secure OAuth flows for social logins without storing client secrets. This skill enables PKCE support for custom OIDC providers, enhancing security for native apps by preventing token interception. It also helps troubleshoot JWT and token-type-mismatch errors common in mobile environments.
An enterprise uses Clerk for internal admin dashboards where administrators manage user accounts, including forcing password resets for compromised credentials. This skill provides tools for user type consistency, organization reporting, and handling production issues like GCP outages, ensuring reliable access control and audit trails.
Monetize API access by charging for API key creation and verification. This model leverages Clerk's API keys beta, with pricing at $0.001 per key creation and $0.0001 per verification, generating revenue from developers and organizations needing programmatic integration. It scales with user adoption and usage volume.
Offer tiered subscription plans with authentication features, using Clerk's billing APIs for managing plans and statements. Revenue comes from monthly or annual subscriptions, with breaking changes handled to ensure billing continuity. This model suits platforms requiring user management and recurring payments.
Provide services to help clients upgrade to Next.js 16 and migrate to API version 2025-11-10, addressing breaking changes and preventing documented errors. Revenue is generated through project-based fees or hourly rates for troubleshooting JWKS, CSRF, and token issues, targeting businesses undergoing tech stack updates.
💬 Integration Tip
Always update to @clerk/[email protected]+ for Next.js 16 compatibility and use proxy.ts instead of middleware.ts to avoid security vulnerabilities. Test API key verification and webhooks in staging before production deployment.
Scored Apr 19, 2026
Self-hosted auth for TypeScript/Cloudflare Workers with social auth, 2FA, passkeys, organizations, RBAC, and 15+ plugins. Requires Drizzle ORM or Kysely for D1 (no direct adapter). Self-hosted alternative to Clerk/Auth.js. Use when: self-hosting auth on D1, building OAuth provider, multi-tenant SaaS, or troubleshooting D1 adapter errors, session caching, rate limits, Expo crashes, additionalFields bugs.
Clerk integration. Manage Users, Organizations. Use when the user wants to interact with Clerk data.
Sentry API integration with managed authentication. Monitor errors, issues, and application performance. Use this skill when users want to list issues, retrieve events, manage projects, teams, or releases in Sentry. For other third party apps, use the api-gateway skill (https://clawhub.ai/byungkyu/api-gateway). Calls run through the `maton` CLI with OAuth login, or over raw HTTP with a Maton API key where the CLI cannot be installed. Every call is authenticated as the user's connection and reaches only what that connection's authorization allows, which the provider enforces on every request; the endpoints documented here are the ones this skill uses, and any other endpoint of this app needs the user to ask for it by name. Default to read and list calls, and confirm every write or new connection with the user. This file also documents the three constructs that turn a Sentry connection into automation, in the order they are used: the connection (the first step), a hosted function that runs a Sentry action through the Maton SDK, and a trigger that calls that function on a schedule or on an event. Those sections are the platform's own reference text, shared with the api-gateway skill, with Sentry examples; they add no Sentry capability - Sentry is not an event source, a trigger cannot read Sentry data, and the files under `references/<source>/triggers.md` are the platform's event catalogues for the sources Maton offers (time, Calendly, GitHub, Gmail, HubSpot, Linear, Notion, Slack, Stripe).
OneNote API integration with managed OAuth via Microsoft Graph. Access notebooks, sections, section groups, and pages. Use this skill when users want to create or manage OneNote notebooks, organize notes, or work with page content. For other third party apps, use the api-gateway skill (https://clawhub.ai/byungkyu/api-gateway). Calls run through the `maton` CLI with OAuth login, or over raw HTTP with a Maton API key where the CLI cannot be installed. Every call is authenticated as the user's connection and reaches only what that connection's authorization allows, which the provider enforces on every request; the endpoints documented here are the ones this skill uses, and any other endpoint of this app needs the user to ask for it by name. Default to read and list calls, and confirm every write or new connection with the user. This file also documents the three constructs that turn an OneNote connection into automation, in the order they are used: the connection (the first step), a hosted function that runs an OneNote action through the Maton SDK, and a trigger that calls that function on a schedule or on an event. Those sections are the platform's own reference text, shared with the api-gateway skill, with OneNote examples; they add no OneNote capability - OneNote is not an event source, a trigger cannot read OneNote data, and the files under `references/<source>/triggers.md` are the platform's event catalogues for the sources Maton offers (time, Calendly, GitHub, Gmail, HubSpot, Linear, Notion, Slack, Stripe).
Download YouTube videos by URL in various resolutions using a pay-per-use API with credit-based authentication and no charge on failed downloads.
Podio API integration with managed OAuth. Manage workspaces, apps, items, tasks, and comments. Use this skill when users want to read, create, update, or delete Podio items, manage tasks, or interact with Podio apps and workspaces. For other third party apps, use the api-gateway skill (https://clawhub.ai/byungkyu/api-gateway). Calls run through the `maton` CLI with OAuth login, or over raw HTTP with a Maton API key where the CLI cannot be installed. Every call is authenticated as the user's connection and reaches only what that connection's authorization allows, which the provider enforces on every request; the endpoints documented here are the ones this skill uses, and any other endpoint of this app needs the user to ask for it by name. Default to read and list calls, and confirm every write or new connection with the user. This file also documents the three constructs that turn a Podio connection into automation, in the order they are used: the connection (the first step), a hosted function that runs a Podio action through the Maton SDK, and a trigger that calls that function on a schedule or on an event. Those sections are the platform's own reference text, shared with the api-gateway skill, with Podio examples; they add no Podio capability - Podio is not an event source, a trigger cannot read Podio data, and the files under `references/<source>/triggers.md` are the platform's event catalogues for the sources Maton offers (time, Calendly, GitHub, Gmail, HubSpot, Linear, Notion, Slack, Stripe).