[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or setup this action to publish automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

clerk@4.1.0

Minor Changes

• Sign in from a machine without a browser: clerk auth login now accepts the URL your browser lands on after signing in on another device, pasted back into the terminal. (#513) by @wyattjoh

• Let AI agents take a Clerk application to production. (#550) by @shane-kercheval

  • clerk deploy --domain <domain> in agent mode creates the production instance (or resumes the existing one) without prompting and prints the deploy report. Without --domain it stays read-only. In the wizard, --domain skips the domain prompt and --yes skips the confirmations.
  • clerk deploy --domain refuses a domain it can't apply: with an existing production instance on another domain it fails with production_instance_exists, and while Clerk hasn't returned the existing instance's domain yet it fails with the new deploy_domain_unchecked, in agent mode and the wizard alike. A wizard run whose typed domain loses a create race to another run's instance stops the same way, rather than carrying on into that instance's setup.
  • clerk deploy refuses more hosting providers' domains, both in --domain and at the wizard's domain prompt: *.replit.app, *.replit.dev, *.onrender.com, *.railway.app, *.emergent.host, *.emergentagent.com, *.web.app, *.firebaseapp.com, *.hosted.app, *.workers.dev, *.github.io, *.lovable.app, *.bolt.host, and *.base44.app, alongside *.vercel.app and the others it already refused. clerk deploy needs a domain whose DNS records you can add.
  • A 404 on the production domain's status, in clerk deploy, clerk deploy status, or the wizard's DNS polling, now fails with deploy_instance_unresolved instead of not_linked and its advice to re-link the directory. Unless the run just created the instance, the message adds that if the production instance was deleted, clerk deploy status reports not_started once Clerk stops listing it, and to run clerk deploy --domain then.
  • The deploy report gains oauth.setup: for each provider missing production credentials, the redirect URI, authorized origins, fields, and the clerk config patch payload and command that save them. nextAction now names the command to run instead of handing off to a human terminal, except for Apple's private key and, when the app uses native-only Sign in with Apple, Apple web credentials, which still go through clerk deploy in a terminal. OAuth secrets go into a file outside the project that the user fills in and that is removed afterward. When native-only Sign in with Apple isn't ready in production, Apple is left out of oauth.setup so the native fix in nextAction isn't buried. Once Clerk's side is complete, nextAction says to pipe the production keys into the host's CLI without reading them, and the new hostSetup field holds the command for Vercel (with host, label, shells, and command), so an agent copies it verbatim from the field instead of out of the sentence. On macOS and Linux, that command and each oauth.setup command start with clerk only when the clerk on PATH resolves to the running binary itself, and otherwise with the running CLI's quoted absolute path (an npm or bun global install puts npm's launcher script on PATH, so it gets the binary's path), so they work when the CLI was started with npx. On Windows they keep clerk. hostSetup is [] in every other state.
  • clerk env pull --print prints KEY=value lines to stdout instead of writing an env file, for sending production keys to a hosting provider. It fails without printing anything when Clerk returns no secret key. For an unclaimed accountless app, whose keys exist only on this machine, it prints the secret key alone, with a warning, when no publishable key is found locally.
  • clerk config patch and clerk config put print [REDACTED] in place of the value of any key whose name contains secret or private_key (in any case), in the diff they show before writing and in the response they print after (dry runs included). Values under other keys are printed as before. Both refuse a payload that still holds [REDACTED] under such a key, naming each field, so their own output can't be saved over a real secret. Error bodies logged under --verbose are not redacted.
  • clerk config patch and clerk config put refuse a payload that still holds an oauth.setup placeholder (<client_secret> under client_secret), naming each such field, and clerk deploy status no longer counts such a value as a saved credential.

• clerk init --template <name> now implies --accountless, so it creates a pre-configured accountless application even when you're signed in or the project is linked, instead of exiting with an error. It still errors with --login, --app, or a framework without accountless support. (#572) by @manovotny

• clerk doctor checks an iOS or macOS app's Release build against the production instance: that Release's Bundle ID is registered there with Native API enabled, that its entitlements list the production Associated Domain, and that it configures Clerk with the production publishable key when the key is loaded in a way that can be read without building (otherwise it reports the key as not verified). Without a production instance this is a single note. Run in an Xcode project, clerk deploy and clerk deploy status now point to clerk doctor for this check. (#548) by @seanperez29

• Create a new iOS or macOS app with clerk init --starter: pick iOS (SwiftUI) or macOS (SwiftUI) on a Mac with Xcode, and init writes a SwiftUI Xcode project, then sets up Clerk, the sign-in screen, and native registration. Use --framework ios or --framework macos with --name, --bundle-id, and the new --team-id to skip the prompts. (#547) by @seanperez29

• Add clerk migrate export auth0, and let clerk migrate import read Auth0 exports, including the NDJSON file from Auth0's bulk export job. clerk migrate is still experimental and needs CLERK_EXPERIMENTAL=migrate. (#526) by @royanger

• Add clerk migrate export authjs, and let clerk migrate import read Auth.js exports. The export reads an Auth.js database over --db-url (Postgres, MySQL, libsql/Turso or SQLite), finding the user table whether Prisma or Drizzle named it. Auth.js stores no passwords, so imported users sign in with OAuth or an email link, or set a password. The export reads each user's OAuth providers, so the import can offer to turn them on, and warns that Auth.js leaves OAuth users' emails unverified; --trust-oauth-emails marks them verified. clerk migrate is still experimental and needs CLERK_EXPERIMENTAL=migrate. (#529) by @royanger

• Add clerk migrate export betterauth, and let clerk migrate import read Better Auth exports. The export reads a Better Auth database over --db-url (Postgres, MySQL, libsql/Turso or SQLite), including schemas Drizzle generated with snake_case columns or plural tables, and detects plugin columns. Better Auth's scrypt, bcrypt and argon2 passwords carry across when Clerk can verify them; any other is dropped, and that user resets it. Anonymous users are skipped. A user that a source skips, such as Supabase's soft-deleted users, no longer stops the import: it's recorded as skipped, and --allow-partial is only for real rejects. clerk migrate is still experimental and needs CLERK_EXPERIMENTAL=migrate. (#528) by @royanger

• Add clerk migrate export clerk and clerk migrate export supabase, and let clerk migrate import take the export's run ID in place of a file and --source. clerk migrate is still experimental and needs CLERK_EXPERIMENTAL=migrate. (#524) by @royanger

• Add clerk migrate export firebase, and let clerk migrate import read Firebase exports with their password hashes. The project's hash parameters come from the export, the --firebase-* flags, or CLERK_FIREBASE_SIGNER_KEY, CLERK_FIREBASE_SALT_SEPARATOR, CLERK_FIREBASE_ROUNDS and CLERK_FIREBASE_MEM_COST. clerk migrate is still experimental and needs CLERK_EXPERIMENTAL=migrate. (#525) by @royanger

• Add clerk migrate runs and clerk migrate undo, and let a re-run of clerk migrate import continue where a stopped one left off. clerk migrate is still experimental and needs CLERK_EXPERIMENTAL=migrate. (#515) by @royanger

  Every user an import creates now carries clerkMigrateRun (the run's ID) in its private_metadata, replacing any value the source had under that key. A re-run reads it to adopt a user whose create was cut off. Nothing removes it afterwards, and your backend can read it.

• Add clerk migrate export workos, and let clerk migrate import read WorkOS exports. WorkOS returns no password hashes, so imported users reset their password or sign in with SSO. clerk init now also flags a WorkOS install and links the migration guide. clerk migrate is still experimental and needs CLERK_EXPERIMENTAL=migrate. (#527) by @royanger

• Add clerk security: audit grades an instance against Clerk's security recommendations, fix applies them as one config patch, and checks lists the catalog. Agent mode gets the report as JSON with the exact patch per finding. (#478) by @dominic-clerk

• Agents can create iOS and macOS apps end to end with JSON. clerk init --starter --framework ios --json (or macos) runs non-interactively and reports a missing name, an existing folder, a Bundle ID, or a team as an input-required status before anything is written. Every status after the app is written names it and the command that finishes it, and setup that stops after writing reports setup-interrupted instead of leaving an agent to retry --starter. A new app that would otherwise inherit a parent's or repository's link asks which application to use. (#583) by @seanperez29

Patch Changes

• Wrap the sign-in and sign-up pages that clerk init creates for Next.js App Router apps in <Suspense>, so they no longer fail next build when Cache Components is enabled, as it is in new create-next-app projects. (#560) by @manovotny

• In agent mode, clerk init --app no longer silently replaces a link to a different application. Inside a Git repository that link is shared by every project there, so relinking one folder switched them all. clerk init now stops, explains what would switch, and asks for --relink; with --json, it reports an input-required status. (#582) by @seanperez29

• Skip creating sign-in and sign-up pages in clerk init for Next.js App Router apps that already have them inside a route group, such as app/(marketing)/sign-in/[[...sign-in]]/page.tsx, instead of adding a second page for the same URL. (#571) by @manovotny

• Wrap the auth header that clerk init --starter adds to Next.js App Router layouts in <Suspense>, so new apps no longer fail next build when Cache Components is enabled, as it is in new create-next-app projects. (#567) by @manovotny

• Print plain text without terminal color codes in agent mode, so AI agents no longer see escape sequences in command output when they run without --json. Pass --mode human or set CLERK_MODE=human to keep colors. Status messages now also honor NO_COLOR. (#534) by @royanger

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 9700215d-dddc-4717-9893-19e25e89417a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}