Commit 4e69553

Methods for supported platforms can be imported from the specific path:

async function handler(req, event) {

// ...

}

To use with [Edge Functions](https://vercel.com/docs/concepts/functions/edge-functions) :

async function handler(req, event) {

// ...

}

Supported methods:

- `verifySessionToken`

- Resources API through `ClerkAPI`

Clerk's JWT session token, contains the azp claim, which equals the Origin of the request during token generation. You can provide the middlewares with a list of whitelisted origins to verify against, to protect your application of the subdomain cookie leaking attack. You can find an example below:

async function handler(req, event) {

// ...

}

import {

AuthStatus,

Base,

type Middleware = (

req: NextRequest,

) => Response | void | Promise<Response | void>;

algorithm: Algorithm,

key: CryptoKey,

signature: Uint8Array,

) => {

return await crypto.subtle.verify(algorithm, key, signature, data);

'X-Clerk-SDK': `vercel-edge/${LIB_VERSION}`,

},

...(body && { body: JSON.stringify(body) }),

},

export type MiddlewareOptions = {

authorizedParties?: string[];

return async function clerkAuth(req: NextRequest, event: NextFetchEvent) {

cookieToken: req.cookies['__session'],

clientUat: req.cookies['__client_uat'],

headerToken: req.headers.get('authorization'),

referrer: req.headers.get('referrer'),

authorizedParties: authorizedParties,

fetchInterstitial,

if (status === AuthStatus.SignedOut) {

return handler(req, event);

if (status === AuthStatus.SignedIn) {

// @ts-ignore

req.session = session;

return handler(req, event);

}

};

middlewares that can be used in the standard manner:

You can then implement your own logic for handling a logged-in or logged-out user in your express endpoints or custom

middleware, depending on whether your users are trying to access a public or protected resource.

If you want to use the express middleware of your custom `Clerk` instance, you can use:

Where `clerk` is your own instance.

If you prefer that the middleware renders a 401 (Unauthenticated) itself, you can use the following variant instead:

your <a href="https://nextjs.org/docs/api-routes/api-middlewares" target="_blank">Next.js api middleware</a> aware of the Clerk Session.

You can define your handler function with the usual signature (`function handler(req, res) {}`) then wrap it

Note: Since the request will be extended with a session property, the signature of your handler in TypeScript would be:

if (req.session) {

// do something with session.userId

} else {

// Respond with 401 or similar

}

}

You can also pass an `onError` handler to the underlying Express middleware that is called (see previous section):

In case you would like the request to be rejected automatically when no session exists,

without having to implement such logic yourself, you can opt for the stricter variant:

In this case your handler can be even simpler because the existence of the session can be assumed, otherwise the

execution will never reach your handler:

// do something with session.userId

}

Note that by default the error returned will be the Clerk server error encountered (or in case of misconfiguration, the error raised by the SDK itself).

yourself (e.g. named `clerk`), you can use the following syntax instead:

Clerk's JWT session token, contains the azp claim, which equals the Origin of the request during token generation. You can provide the middlewares with a list of whitelisted origins to verify against, to protect your application of the subdomain cookie leaking attack. You can find an example below:

const authorizedParties = ['http://localhost:3000', 'https://example.com']

// do something with session.userId

}

- In development mode, do your frontend & API reside on the same domain? Unless the clerk `__session` is sent to your API server, the SDK will fail to authenticate your user.

- If you are still experiencing issues, it is advisable to set the `CLERK_LOGGING` environment variable to `true` to get additional logging output that may help identify the issue.

Please ensure you are not mounting them on routes that are meant to be publicly accessible.

Please report issues or open feature request in

import {

} from '@clerk/clerk-sdk-node';

import dotenv from 'dotenv';

import express, { Application, Request, Response } from 'express';

'/',

res.json(req.session || 'No session detected');

}

'/require-session',

res.json(req.session);

}

Base,

ClerkBackendAPI,

ClerkFetcher,

Session,

} from '@clerk/backend-core';

import Cookies from 'cookies';

import deepmerge from 'deepmerge';

import type { NextFunction, Request, Response } from 'express';

import got, { OptionsOfUnknownResponseBody } from 'got';

import jwks, { JwksClient } from 'jwks-rsa';

import querystring from 'querystring';

authorizedParties?: string[];

export type WithSessionProp<T> = T & { session?: Session };

export type RequireSessionProp<T> = T & { session: Session };

import { Crypto, CryptoKey } from '@peculiar/webcrypto';

async verifyToken(

token: string,

authorizedParties?: string[]

const decoded = jwt.decode(token, { complete: true });

if (!decoded) {

throw new Error(`Failed to verify token: ${token}`);