You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardexpand all lines: packages/backend/src/jwt/verifyJwt.ts
+16
Original file line number
Diff line number
Diff line change
@@ -94,9 +94,25 @@ export function decodeJwt(token: string): JwtReturnType<Jwt, TokenVerificationEr
94
94
}
95
95
96
96
exporttypeVerifyJwtOptions={
97
+
/**
98
+
* A string or list of [audiences](https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.3). If passed, it is checked against the `aud` claim in the token.
99
+
*/
97
100
audience?: string|string[];
101
+
/**
102
+
* An allowlist of origins to verify against, to protect your application from the subdomain cookie leaking attack.
* Specifies the allowed time difference (in milliseconds) between the Clerk server (which generates the token) and the clock of the user's application server when validating a token. Defaults to 5000 ms (5 seconds).
Copy file name to clipboardexpand all lines: packages/backend/src/tokens/types.ts
+79-33
Original file line number
Diff line number
Diff line change
@@ -2,68 +2,114 @@ import type { ApiClient } from '../api';
2
2
importtype{VerifyTokenOptions}from'./verify';
3
3
4
4
exporttypeAuthenticateRequestOptions={
5
+
/**
6
+
* The Clerk Publishable Key from the [**API keys**](https://dashboard.clerk.com/last-active?path=api-keys) page in the Clerk Dashboard.
7
+
*/
5
8
publishableKey?: string;
9
+
/**
10
+
* The domain of a [satellite application](https://clerk.com/docs/advanced-usage/satellite-domains) in a multi-domain setup.
11
+
*/
6
12
domain?: string;
13
+
/**
14
+
* Whether the instance is a satellite domain in a multi-domain setup. Defaults to `false`.
15
+
*/
7
16
isSatellite?: boolean;
17
+
/**
18
+
* The proxy URL from a multi-domain setup.
19
+
*/
8
20
proxyUrl?: string;
21
+
/**
22
+
* The sign-in URL from a multi-domain setup.
23
+
*/
9
24
signInUrl?: string;
25
+
/**
26
+
* The sign-up URL from a multi-domain setup.
27
+
*/
10
28
signUpUrl?: string;
29
+
/**
30
+
* Full URL or path to navigate to after successful sign in. Defaults to `/`.
31
+
*/
11
32
afterSignInUrl?: string;
33
+
/**
34
+
* Full URL or path to navigate to after successful sign up. Defaults to `/`.
35
+
*/
12
36
afterSignUpUrl?: string;
37
+
/**
38
+
* Used to activate a specific [organization](https://clerk.com/docs/organizations/overview) or [personal account](https://clerk.com/docs/organizations/organization-workspaces#organization-workspaces-in-the-clerk-dashboard:~:text=Personal%20account) based on URL path parameters. If there's a mismatch between the active organization in the session (e.g., as reported by `auth()`) and the organization indicated by the URL, an attempt to activate the organization specified in the URL will be made.
39
+
*
40
+
* If the activation can't be performed, either because an organization doesn't exist or the user lacks access, the active organization in the session won't be changed. Ultimately, it's the responsibility of the page to verify that the resources are appropriate to render given the URL and handle mismatches appropriately (e.g., by returning a 404).
* Defines the options for syncing an organization or personal account state from the URL to the clerk session.
19
-
* Useful if the application requires the inclusion of a URL that indicates that a given clerk organization
20
-
* (or personal account) must be active on the clerk session.
21
-
*
22
-
* If a mismatch between the active organization on the session and the organization as indicated by the URL is
23
-
* detected, an attempt to activate the given organization will be made.
24
-
*
25
-
* WARNING: If the activation cannot be performed, either because an organization does not exist or the user lacks
26
-
* access, then the active organization on the session will not be changed (and a warning will be logged). It is
27
-
* ultimately the responsibility of the page to verify that the resources are appropriate to render given the URL,
28
-
* and handle mismatches appropriately (e.g. by returning a 404).
50
+
* @expand
29
51
*/
30
52
exporttypeOrganizationSyncOptions={
31
53
/**
32
-
* URL patterns that are organization-specific and contain an organization ID or slug as a path token.
33
-
* If a request matches this path, the organization identifier will be extracted and activated before rendering.
54
+
* Specifies URL patterns that are organization-specific, containing an organization ID or slug as a path parameter. If a request matches this path, the organization identifier will be used to set that org as active.
34
55
*
35
-
* WARNING: If the organization cannot be activated either because it does not exist or the user lacks access,
36
-
* organization-related fields will be set to null. The server component must detect this and respond
37
-
* with an appropriate error (e.g., notFound()).
56
+
* If the route also matches the `personalAccountPatterns` prop, this prop takes precedence.
38
57
*
39
-
* If the route also matches the personalAccountPatterns, this takes precedence.
58
+
* Patterns must have a path parameter named either `:id` (to match a Clerk organization ID) or `:slug` (to match a Clerk organization slug).
40
59
*
41
-
* Must have a path token named either ":id" (matches a clerk organization ID) or ":slug" (matches a clerk
42
-
* organization slug).
60
+
* @warning
61
+
* If the organization can't be activated—either because it doesn't exist or the user lacks access—the previously active organization will remain unchanged. Components must detect this case and provide an appropriate error and/or resolution pathway, such as calling `notFound()` or displaying an [`<OrganizationSwitcher />`](https://clerk.com/docs/components/organization/organization-switcher).
* URL patterns for resources in the context of a clerk personal account (user-specific, outside any organization).
53
-
* If the route also matches the organizationPattern, the organizationPatterns takes precedence.
73
+
* URL patterns for resources that exist within the context of a [Clerk Personal Account](https://clerk.com/docs/organizations/organization-workspaces#organization-workspaces-in-the-clerk-dashboard:~:text=Personal%20account) (user-specific, outside any organization).
54
74
*
55
-
* Common examples:
56
-
* - ["/user", "/user/(.*)"]
57
-
* - ["/user/:any", "/user/:any/(.*)"]
75
+
* If the route also matches the `organizationPattern` prop, the `organizationPattern` prop takes precedence.
76
+
*
77
+
* @example
78
+
* ["/user", "/user/(.*)"]
79
+
* @example
80
+
* ["/user/:any", "/user/:any/(.*)"]
58
81
*/
59
82
personalAccountPatterns?: Pattern[];
60
83
};
61
84
62
85
/**
63
-
* A pattern representing the structure of a URL path.
64
-
* In addition to a valid URL, may include:
65
-
* - Named path tokens prefixed with a colon (e.g., ":id", ":slug", ":any")
66
-
* - Wildcard token (e.g., ".(*)"), which will match the remainder of the path
* Used to verify the session token in a networkless manner. Supply the PEM public key from the **[**API keys**](https://dashboard.clerk.com/last-active?path=api-keys) page -> Show JWT public key -> PEM Public Key** section in the Clerk Dashboard. **It's recommended to use [the environment variable](https://clerk.com/docs/deployments/clerk-environment-variables) instead.** For more information, refer to [Manual JWT verification](https://clerk.com/docs/backend-requests/handling/manual-jwt).
* `Auth` object of the currently active user and the `redirectToSignIn()` method.
16
+
*/
17
+
typeAuth=AuthObject&{
18
+
/**
19
+
* The `auth()` helper returns the `redirectToSignIn()` method, which you can use to redirect the user to the sign-in page.
20
+
*
21
+
* @param [returnBackUrl] {string | URL} - The URL to redirect the user back to after they sign in.
22
+
*
23
+
* @note
24
+
* `auth()` on the server-side can only access redirect URLs defined via [environment variables](https://clerk.com/docs/deployments/clerk-environment-variables#sign-in-and-sign-up-redirects) or [`clerkMiddleware` dynamic keys](https://clerk.com/docs/references/nextjs/clerk-middleware#dynamic-keys).
* | No | No | Redirect the user to the sign-in page\*. |
42
+
*
43
+
* @important
44
+
* \*For non-document requests, such as API requests, `auth.protect()` returns a `404` error to users who aren't authenticated.
45
+
*
46
+
* `auth.protect()` can be used to check if a user is authenticated or authorized to access certain parts of your application or even entire routes. See detailed examples in the [dedicated guide](https://clerk.com/docs/organizations/verify-user-permissions).
47
+
*/
18
48
protect: AuthProtect;
19
49
}
20
50
51
+
/**
52
+
* The `auth()` helper returns the [`Auth`](https://clerk.com/docs/references/backend/types/auth-object) object of the currently active user, as well as the [`redirectToSignIn()`](https://clerk.com/docs/references/nextjs/auth#redirect-to-sign-in) method.
53
+
*
54
+
* - Only available for App Router.
55
+
* - Only works on the server-side, such as in Server Components, Route Handlers, and Server Actions.
56
+
* - Requires [`clerkMiddleware()`](https://clerk.com/docs/references/nextjs/clerk-middleware) to be configured.
* The `currentUser` helper returns the [Backend User](https://clerk.com/docs/references/backend/types/backend-user) object of the currently active user. It can be used in Server Components, Route Handlers, and Server Actions.
8
+
*
9
+
* Under the hood, this helper:
10
+
* - calls `fetch()`, so it is automatically deduped per request.
11
+
* - uses the [`GET /v1/users/{user_id}`](https://clerk.com/docs/reference/backend-api/tag/Users#operation/GetUser) endpoint.
12
+
* - counts towards the [Backend API request rate limit](https://clerk.com/docs/backend-requests/resources/rate-limits#rate-limits).
13
+
*
14
+
* @example
15
+
* ```tsx
16
+
* // app/page.tsx
17
+
*
18
+
* import { currentUser } from '@clerk/nextjs/server'
* To enable Clerk SSR support, include this object to the `props`
11
-
* returned from `getServerSideProps`. This will automatically make the auth state available to
12
-
* the Clerk components and hooks during SSR, the hydration phase and CSR.
12
+
* Clerk uses `buildClerkProps` to inform the client-side helpers of the authentication state of the user. This function is used SSR in the `getServerSideProps` function of your Next.js application.
13
+
*
14
+
* @example
15
+
* **Basic usage**
16
+
*
17
+
* ```tsx
18
+
* // pages/myServerSidePage.tsx
19
+
*
20
+
* import { getAuth, buildClerkProps } from '@clerk/nextjs/server'
0 commit comments