Page 10

Dec 13

Custom Roles and Permissions is in Public Beta

Category: Beta
Published: Dec 13

More control to operate your B2B SaaS via Custom Roles and Permissions

More powerful authorization options

Previously within our Organizations product you had 2 role types to work with (Admin and Member) out-of-the-box. Those roles came with a bunch of default assumptions about how they operated and what rights they each had. For many of our customers, this worked fine – but for a large amount of our more mature customers, you required more. That's where Custom Roles and Permissions comes into play.

With Custom Roles and Permisisons you can now model your application with whatever roles map to your use-case, assign those roles the specific permissions they need and you're on your way. This data gets automatically reflected in your session tokens as claims, ready for you to build out authorization flows within your app.

Customizing your application

We didn't just stop at allowing you to model your application's roles and permissions and enrich your Sessions and JWTs. In pursuit of the best possible DX, like with our <SignUp /> and <SignIn /> components, we took it a step further.

Introducing has(), protect(), and <Protect> - our new authorization helpers. These helpers allow the convenient integration of your custom authorization needs directly inside your apps.

<Protect role="org:admin">
  <Link href="/admin">Admin Panel</Link>
</Protect>

Head to the verifying a user's permissions docs to see all 3 helpers in action.

Learn more

As of today, custom roles and permissions is in public beta. Simply head to the Dashboard and start configuring your application's roles today.

If you're looking for more detail about the release, read through our announcement blog post, or dive right into the Roles and Permission docs.

We're excited to see what you build 🚀.

Other improvements

We added a more visible Dashboard UI when you’re in the context of a Development instance. This helps to better indicate that actions taken, such as copying and rotating keys, or modifying other settings, will not apply to the production environment.
We've improved caching and latency to a handful of our production endpoints.
We've improved the performance of WAU and MAU calculation for the Dashboard. In some of our larger applications, this was preventing you from seeing data beyond a 6 month lookback.

Dec 7

Fetch users by latest activity

Category: API
Published: Dec 7

Get a better understanding of your user's activity by using our updated Backend API endpoints which are now filterable by activity

Filter Users by their latest activity

Use the new last_active_at_since parameter to filter users according to their latest activity date.

For example, if you were interested to know which users were active between 2023-11-23 and the current day, you could construct a query like this:

GET /v1/users?last_active_at_since=1700690400000

Note that session activity is registered continuously throughout the day so a query using a condition with the current day is perfectly valid.

You can also use last_active_at as an ordering parameter to sort users by how recently they were active:

GET /v1/users?order_by=last_active_at

Retrieve a single user's latest activity data

You will also now get last_active_at in your response when retrieving user details with the GET /users/{user_id} endpoint.

Dec 6

Simplified Pricing and updated Billing Dashboard

Category: Dashboard
Published: Dec 6

Introducing a better pricing structure for all companies, and a better way to see your usage.

Simplified pricing structure

We've completely overhauled and simplified our pricing structure. All plans now include 10k MAUs! Our announcement blog post explains the rationale behind this major shift. For a complete break down, check out our beautifully redesigned pricing page.

Updated Billing Dashboard

We've also overhauled the Plan & Billing section of our Dashboard so you can more easily understand your current plans usage. If you're one of the folks who shared that our old billing section was inadequate, this update is for you.

A preview of more to come...

You may notice a new look and feel that it's disjointed with the rest of our site. We're working hard behind the scenes on a complete overhaul of our dashboard! Stay tuned for an improved experience...

Dec 1

Brute-force attack protection with Account Lockout

Category: Security
Published: Dec 1

Fight back against bots and protect your users from brute-force attacks with Account Lockout

What is Account Lockout?

Account Lockout is a feature that protects you and your users from brute-force attacks where bots or other nefarious actors repeatedly attempt to gain access. In addition to our other methods of bot detection, now, when a configurable limit of attempts is exceeded – the user's account will be temporarily locked, and they will be prompted to wait for a cooldown period before they can try again.

This prevents malevolent actors from guessing users' credentials by trying out multiple possible codes in rapid succession (brute-force attack).

What do I need to do to activate it?

Well, nothing. We've enabled Account Lockout on all accounts with default settings that shouldn't be intrusive for your users but will certainly inconvenience bots and scripts.

Starting today, you can head to our User & Authentication > Attack Protection and configure the settings to your application's needs. Specifically, you're able to adjust the number of failed attempts before a user's account is locked and the duration for which they will be prevented from signing in afterwards.

It is also possible to disable Account Lockout, but we highly recommend you keep it on :)

Head to our docs to learn more about brute force attacks and locking user accounts.

Nov 8

Use Clerk with Hono middleware

Category: Community
Published: Nov 8

Hono is a great minimal web framework for building applications across any edge runtime and now with Hono's middleware and our community SDK, you can secure it with Clerk.

Install the middleware

To install the Clerk middleware for Hono, follow the instructions provided to set up and configure the middleware in Hono.

npm i hono @hono/clerk-auth @clerk/backend

Configure the middleware

Before you start using the Clerk middleware, you'll need to set the following environment variables:

CLERK_SECRET_KEY=<your-secret-key>
CLERK_PUBLISHABLE_KEY=<your-publishable-key>

Use the middleware

Here is a quick example on how to use the Clerk middleware for Hono:

import { clerkMiddleware, getAuth } from '@hono/clerk-auth'
import { Hono } from 'hono'

const app = new Hono()

app.use('*', clerkMiddleware())
app.get('/', (c) => {
  const auth = getAuth(c)

  if (!auth?.userId) {
    return c.json({
      message: 'You are not logged in.',
    })
  }

  return c.json({
    message: 'You are logged in!',
    userId: auth.userId,
  })
})

export default app

And that's it. Your app is now secured and running on the edge. Find more about Clerk's Hono middleware on GitHub.

Oct 26

Add custom pages to <UserProfile /> and <OrganizationProfile />

Category: React
Published: Oct 26

Customize your user and organization profiles by adding custom pages and external links to the navigation sidebar.

Previously if you were using Clerk's <UserProfile /> and <OrganizationProfile /> to allow your user's to view and manage their own profile settings your ability to extend them was fairly limited. This meant if you wanted to provide controls for other options outside of what Clerk's defaults, you were stuck. With our latest release, these components now allow for much richer customization. Allowing you to extend Clerk's pre-built components with whatever context is right for your app and your users.

UserProfile Customization

The <UserProfile /> component now supports (view docs):

Custom Pages: Add your app's custom pages inside Clerk's <UserProfile /> UI by passing our new <UserProfile.Page> compound component
External Links: Add external links to the navigation sidebar using the <UserProfile.Link> component
Reordering: Create a custom sidebar by reordering the routes (like our defaults: Account and Security)

Here what an example of how to use our new React API for UserProfile customization:

<UserProfile>
  <UserProfile.Page label="Custom Page" url="custom" labelIcon={<CustomIcon />}>
    <MyCustomPageContent />
  </UserProfile.Page>
  <UserProfile.Link label="External" url="/home" labelIcon={<Icon />} />
  <UserProfile.Page label="account" />
  <UserProfile.Page label="security" />
</UserProfile>

OrganizationProfile Customization

Just like UserProfile, the <OrganizationProfile /> component offers similar customization options for organization profiles (view docs)

Custom Pages
External Links
Reordering (our defaults Members and Settings)

Here is an example of how to use the React API for OrganizationProfile customization:

<OrganizationProfile>
  <OrganizationProfile.Page label="Custom Page" url="custom" labelIcon={<CustomIcon />}>
    <MyCustomPageContent />
  </OrganizationProfile.Page>
  <OrganizationProfile.Link label="External" url="/home" labelIcon={<Icon />} />
  <OrganizationProfile.Page label="members" />
  <OrganizationProfile.Page label="settings" />
</OrganizationProfile>

For more information and implementation instructions, please refer to our documentation for <UserProfile /> and <OrganizationProfile />.

Other Fixes & Improvements

Added support for creating users with SHA-256 algorithm password hashes, via the Backend API. SHA-256 password hashes will be transparently migrated to the more secure Bcrypt algorithm, the first time the user signs in

Clerk Changelog