Clerk Core 3 operator

Wire and repair Clerk sign-in and sign-up flows, covering prebuilt components on catch-all routes versus hosted pages, custom flows with the sign-in and sign-up hooks, redirect configuration and returning a user to where they started, social connections, multi-factor and verification steps, email and password strategies, and an onboarding step after sign-up. Use when sign-in or sign-up must be added or customized, when a flow 404s partway through, or when redirects send users to the wrong place.

Answer quick Clerk questions with a compact reference for environment keys and their scope, prebuilt components, client and server hooks and helpers, middleware and route protection, the backend API for users and organizations, session claims and metadata, webhook verification, and the test versus live instance distinction. Use when someone asks which Clerk component, helper, or backend call to use, or wants a fast lookup rather than a guided workflow.

Inspect which Clerk instance an application targets, which keys it holds and whether any secret is reachable from client code, the middleware and provider wiring, configured sign-in and sign-up paths and redirect URLs, whether organizations are enabled, session token claims, and which webhook endpoints exist, without changing anything. Use before a Clerk operation, when sign-in or route protection misbehaves, when a user seems missing, or when the user asks whether Clerk is set up.

Connect Clerk to the systems around it, covering framework SDKs beyond Next.js, mirroring users and organizations into a local database, scoping every query by the session's organization, protecting an API or another service with a verified token, tying billing to an organization, third-party token templates for a backend that validates independently, and pipeline test and deploy steps. Use when Clerk identity must reach a local table, when another service must trust a Clerk session, or when tenant scoping or billing must be wired.

Discover, compatibility-check, install, update, or explain Clerk's first-party agent skills for Clerk Core 3. Use when asked about Clerk native skills, clerk/skills, agent setup, or whether installed Clerk skills match this Core 3 operator and the project's SDK.

Manage Clerk organizations and their members, covering enabling organizations for an instance, creating organizations and mapping them to a local tenant, memberships with roles and permissions, custom roles, invitations, the active organization on a session and switching it, scoping every query by orgId, and deleting an organization. Use when multi-tenancy must be added, when memberships or roles must change, when orgId is undefined, or when one tenant can see another's data.

Protect routes and read Clerk sessions on the server, covering middleware default-deny protection, auth and auth.protect in server components and route handlers, permission and role checks with has, session token claims and their size limit, verifying a bearer token at an API boundary, session lifetime and revocation, and why component-level gating is not access control. Use when routes must be protected, when auth throws, when a permission check must be added, or when another service must trust a Clerk session.

Set up Clerk in an application from zero, covering the publishable and secret keys and their scope, the provider at the root, middleware with default-deny route protection, sign-in and sign-up routes, redirect configuration, a first protected page, and keeping the development instance separate from production. Use when an application has no Clerk wiring, when middleware or the provider is missing, or when the user asks how to add Clerk.

Diagnose Clerk failures from reproducible evidence, covering wrong instance and mismatched key pairs, auth throwing because middleware is missing or its matcher excludes the route, sign-in redirect loops, flows that 404 partway through, undefined orgId, oversized session tokens, stale session claims, webhook signature failures and protected webhook routes, and authorization that exists only in components. Use when sign-in or protection misbehaves, when a user seems missing, when a flow breaks mid-step, or when events arrive but nothing happens.

Read and change Clerk user records from the server, covering user lookup and pagination, creating and updating users, the three metadata fields and which are user-writable, email and phone identifiers and verification, banning and locking versus deleting, session revocation as part of removing access, and mirroring users into a local table. Use when a user record must be inspected or corrected, when metadata must be set, when a user must be removed or suspended, or when local records must match Clerk.

Receive and handle Clerk webhook events safely, covering endpoint registration per instance, signature verification against the raw request body, keeping the route public in middleware, idempotency keyed on the event id, acknowledging before processing, handling user and organization and membership events, out-of-order delivery, retries, local delivery through a tunnel, and reconciling a mirror when events were missed. Use when a local database must track Clerk users or organizations, when events arrive but nothing happens, when verification fails, or when an event applied twice.