Clerk Changelog

Expo native components now ship in @clerk/expo-native-components, so apps not using them no longer bundle the Clerk iOS and Android SDKs or require iOS 17. The old @clerk/expo/native import path is deprecated and will be removed in the next major version; on Android, apps without the package no longer migrate biometric credentials enrolled with earlier SDK versions.

The API keys page in the Clerk Dashboard no longer displays the full value of existing Secret keys, showing only part of each key so it can be matched to an environment. Existing Secret keys keep working and do not need rotation; code snippets that need a Secret key can now add a new one without leaving the page.

The Clerk MCP server now connects through your MCP client's sign-in flow so an agent can create applications, configure authentication, manage users, and set up production instances alongside SDK snippets and quickstarts, scoped to what you approve and what your workspace role allows.

Enterprise SAML connections now trust up to five signing certificates at once, letting you add an IdP's next certificate before a key rotation so sign-ins keep working across the switch. Certificates are managed as a full list via idp_certificates on the Backend API or the Certificates list in the Dashboard, and the single idp_certificate field still works but is deprecated.

IT admins can now set up Directory Sync for their own SSO connection from the Security tab in , including Google Workspace via Google Admin SDK, instead of relying on a SCIM endpoint and bearer token handed over by the customer's team. Enrollment requires Organizations plus the Pro or Business plan with B2B Authentication add-on in production, and the feature is off until enabled under Organization permissions in the Dashboard.

SSO bypass lets users on a connection's allowlist sign in with a one-time email code when the enterprise IdP is unavailable, via a Can't use SSO? link in the SignIn component, while everyone else must continue using SSO. The allowlist is managed from the Clerk Dashboard or the Backend API, or by Organization members with the org:sys_entconns_sso_bypass:manage system permission, and each successful bypass is recorded as a sign_in.sso_bypass.succeeded event in Application Logs.

An Organization can now have more than one SAML or OIDC enterprise connection, removing the organization_already_has_sso_connection error, and each connection can have its own directory. Clerk tracks each directory's view of a user separately: a user stays active while at least one enabled directory reports them active, and memberships are only deleted when no directory grants them anymore.

Client ID Metadata Documents are generally available for every Clerk application, letting MCP and other public OAuth clients use an HTTPS URL as their client_id that Clerk fetches and validates for identity and redirect URIs, without a pre-issued client ID, client secret, or Dynamic Client Registration. The feature is off by default and must be enabled via Publish CIMD support in the OAuth applications settings, with existing client admission controls including a pre-registered-clients-only mode.

Application Logs now record delivery events for Clerk-sent SMS including phone verification codes, OTPs, and password reset codes, with event types sms.accepted, sms.delivered, sms.failed, sms.undeliverable, and sms.unconfirmed. A dedicated SMS logs view filters by event type or destination phone number, with failure events carrying a normalized reason such as invalid_phone_number or rate_limited; message bodies, verification codes, and provider identity are excluded.

Clerk now supports the OAuth 2.0 device authorization grant, letting CLI tools, TVs, and other input-constrained applications complete device authorization flows. The grant is available today and follows the standard RFC 8628 flow.

Clerk now lets you control how long a successful sign-in or reverification stays valid for sensitive actions, setting the window between 1 and 10 minutes via the Sessions page in the Dashboard. The default remains 10 minutes; a shorter window prompts more frequent credential verification before actions like password changes, email edits, session revocation, or account deletion.

Admin Logs in the Clerk Dashboard records configuration changes made via the Dashboard, Backend API, or Platform API, with filtering by event type, instance, application, actor, IP address, and time range. Available on Business and Enterprise plans, recording starts August 24, 2026; actions before that date aren't included.

Clerk now lets you define custom OAuth scopes (e.g. messages:read, tools:execute) in the Dashboard and assign them per OAuth application, with separate control over which scopes are advertised through OAuth metadata for MCP client discovery. Start from the Scopes tab on the OAuth applications page.

Clerk's mobile SDKs let returning users sign in with Face ID, Touch ID, or Android biometrics by enrolling the current device as trusted; Clerk verifies a device-bound challenge while the private key stays on-device. Prebuilt auth and user profile views can show the enrollment prompt, biometric sign-in button, and current-device toggle, and custom flows can use the trusted-device APIs directly.

Apply percentage or fixed-amount discounts to any subscription from the Dashboard, or issue promo codes customers redeem at checkout. Discounts support any duration or per-period amounts and can be capped or restricted to new subscribers.

Clerk's OAuth provider now supports Client ID Metadata Documents (CIMD) in beta, letting MCP and other public OAuth clients use an HTTPS URL as their client_id instead of a pre-issued ID, client secret, or Dynamic Client Registration. A new CIMD Clients tab on the OAuth applications page controls which clients can connect, with options to pre-register clients, block unknown ones, and advertise CIMD support in the authorization server metadata.

Clerk's OAuth provider now supports Client ID Metadata Documents (CIMD) in beta, letting MCP and other public OAuth clients use an HTTPS URL as their client_id. Admins control admission via a new CIMD Clients tab, with options to allow or block unknown clients.

Clerk Directory Sync now supports Google Workspace, connecting directly to your directory to sync users, groups, and group memberships via a service account. Supports role mapping for groups and custom attribute mapping including standard fields and Workspace custom schemas.

SignIn component now supports the combined sign-in-or-up flow under strict user enumeration protection, with no code changes required. Visitors verify their identity before Clerk signs them in or creates the account.

Customers' IT admins can now configure custom OpenID Connect connections from the Security tab in <OrganizationProfile />, alongside the existing SAML support. Self-serve SSO is enabled per Organization from the Clerk Dashboard.