Clerk

Recently shipped a role mapping step for self-serve Directory Sync and lifted the one-connection-per-Organization limit.

Directory Sync now maps directory groups to organization roles. Admins configuring SCIM in <OrganizationProfile /> assign a role to each group the IdP pushes, choose which group wins when a member belongs to several, and can turn role syncing off. Unmapped members keep the organization's default role; the step is read-only without the org:sys_memberships:manage permission.

An Organization can hold more than one enterprise connection. A second SAML or OIDC connection used to fail with organization_already_has_sso_connection; that limit is gone, so acquisitions, IdP migrations, and subsidiaries each point their own connection at the same Organization.

Client ID Metadata Documents are generally available. MCP and other public OAuth clients can use an HTTPS URL as client_id, with Clerk fetching the metadata document there to validate identity and redirect URIs — no pre-issued ID, secret, or Dynamic Client Registration. Off by default behind Publish CIMD support.

SMS delivery is traceable in Application Logs. Accepted, delivered, failed, undeliverable, and unconfirmed events show whether a missing verification code ever reached the handset.

SSO survives IdP key rotations and outages. SAML connections trust up to five signing certificates, so the next certificate goes in before the IdP switches and comes out after; saml.idpCertificate is deprecated in favor of saml.idpCertificates. Allowlisted users who can't reach their IdP get a Can't use SSO? link on <SignIn /> and an email-code session.

Smaller: handleRedirectCallback() and <AuthenticateWithRedirectCallback /> take an enterpriseConnectionsUrl option for OAuth sign-ups that must pick between enterprise connections sharing an email domain. @clerk/electron reached 0.1.0 with an experimental React entry point and a clearer error when createClerkBridge() is called without a renderer.