Clerk's directory sync gets role mapping as Auth0 opens up token scopes

Enterprise identity gets more forgiving

Clerk spent the week making enterprise setups survive change. Admins configuring Directory Sync from the self-serve flow inside OrganizationProfile can now assign an organization role to each directory group their IdP pushes, pick which group wins when someone belongs to several, and toggle role syncing off entirely — a capability that landed across the shared SDK, the UI package, and the localizations bundle at once so the setup screen, the underlying hooks, and the strings ship together. Members who fall into no mapped group keep the organization's default role, and the step stays read-only for anyone without org:sys_memberships:manage.

SAML connections got the same treatment for key rotations: Clerk now trusts up to five signing certificates on a connection, so you can park an IdP's next certificate in the Dashboard before the rotation happens and sign-ins keep working across the switch. The old single-certificate field still parses but is deprecated, and the certificate list is manageable through idp_certificates on the Backend API. Alongside it, handleRedirectCallback() and AuthenticateWithRedirectCallback gained an enterpriseConnectionsUrl option for choosing between multiple enterprise connections that share an email domain — useful when one company runs several IdPs behind the same domain.

On the Auth0 side, access token scope customization for Actions left early access and reached GA, now covering Post Login Actions as well as Credentials Exchange. Actions can add, remove, set, or clear the scopes considered when an access token is issued; removals are always honored, additions only granted when the user and application are actually authorized, and event.transaction.target_scopes reflects changes across chained Actions. The practical effect is that scope narrowing can be enforced centrally rather than duplicated in every API.

Client-side fixes and the iOS session model

Clerk's iOS SDK put out a run of updates mostly aimed at correctness around sessions. It now only authorizes active sessions in Clerk.has rather than any session object lying around, and the code resend countdown keeps running for its full cooldown instead of resetting, with a failed reconfigure that wiped local data now signing out in memory rather than leaving a stale session behind. A third pass cleaned up decoding: null role and permission descriptions, enterprise connections without a logo, and session actors that weren't being parsed as JSON all decode correctly now, credit ledger timestamps read as RFC 3339, and the Delete account row follows the user's deleteSelfEnabled flag.

Elsewhere in the JavaScript SDK, the Electron bridge now throws a Clerk error asking for the renderer option in createClerkBridge() instead of surfacing Electron's cryptic "No handler registered", and TanStack Start users need Start 1.168.10 or newer and must register createCsrfMiddleware() ahead of clerkMiddleware() to restore CSRF protection that gets skipped when src/start.ts is present. Two smaller cleanups landed too: <HandleSSOCallback /> is exported from the main @clerk/nextjs entry so custom flows can import it, and a Protect challenge failing on the SSO callback no longer swallows the error — it surfaces on useSignIn()/useSignUp() and routes failed sign-ups to sign-up rather than sign-in. Expo's useBiometricCredentials() also gained revokeCurrentDeviceCredential() so you can drop this device's passkey without holding onto the ID from enroll(). The rest of the week was the usual dependency ripple — shared, backend, and the framework wrappers moving in step — plus a wording fix clarifying that clerk init needs no account and writes temporary dev keys.