Clerk

Recently shipped customizable reverification windows, Admin Logs, and biometric sign-in for mobile SDKs.

Reverification windows are now tunable. Set how recently a successful sign-in or reverification stays valid for sensitive actions like changing a password or deleting an account, from 1 to 10 minutes (default remains 10). Configure it under Session lifetime in the Dashboard.

Admin Logs bring an audit trail to the Dashboard. Track configuration changes across your workspace—from the Dashboard, Backend API, or Platform API—including OAuth app creation, secret rotation, and Role and Permission management, with filtering and search.

Biometric sign-in landed for Expo, iOS, and Android. Return users can enroll a trusted device, then sign in with Face ID, Touch ID, or Android biometrics via a device-bound challenge. Prebuilt auth views show the enrollment prompt and sign-in button; custom flows use the useTrustedDevices API.

Custom OAuth scopes give MCP clients precise access. Define scopes like messages:read or tools:execute, assign them per OAuth application, and advertise select scopes in metadata for client discovery.

Mobile and JS SDK polish. @clerk/expo-google-signin now reports Google's stable sub identifier as user.id on Android, matching iOS. @clerk/ui added a Back action to authenticator-app verification that reuses the existing TOTP secret. The iOS SDK added billing APIs for plans, subscriptions, and credits, plus checkAuthorization and has checks. Ticket-based sign-in flows that start before loading now finalize correctly.