Clerk Changelog

Agents can now give product feedback through your MCP server. When a tool is missing, something unexpected happens, or an agent gets stuck, the agent often knows what would have helped, but you have no way to hear about it.

Add the submit_feedback tool from @clerk/mcp-tools⁠ to your MCP server, and agents report friction as they run into it. Your own agent can then read the reports through Clerk's MCP server and fix what other agents keep running into. For example:

• "Summarize the feedback on my application."
• "Look at the blocked reports and come up with new tools to add."

Get started

See Collect feedback from agents using your MCP server to add the tool to your MCP server.

Clerk Protect helps stop fake accounts and account takeover attacks with protections you can configure in the Clerk Dashboard. Clerk secures more than 100,000 active applications. Protect brings what we've learned fighting fraud and abuse directly into your authentication flows.

New protections on the Business plan

The Business plan now includes five advanced protections to give you more control over who can sign up:

• Block sign-ups from suspicious network types, such as VPNs, Tor, proxies, and hosting networks.
• Challenge residential proxies to make automated abuse more costly while keeping sign-up smooth for legitimate users.
• Block sign-ups by country using a blocklist or an allowlist.
• Limit sign-ups per IP address to an hourly limit you set.
• Block risky email domains at a protection level you choose.

Protections for every application

Every application includes the following protections:

• Challenge suspicious sign-ups with a CAPTCHA to help stop automated account creation.
• Require Device Intelligence checks to check for signs of automation in browser-based interactions.
• Lock accounts after failed sign-ins to protect your users against targeted brute-force attacks.
• Device Trust requires additional verification when someone signs in from a new device, helping protect users against stolen credentials.
• User enumeration protection helps prevent attackers from discovering which email addresses and phone numbers have accounts.
• Block email subaddresses to reduce the number of accounts one person can create from a single inbox with variations like user+1@example.com.
• Block disposable email addresses to stop sign-ups from throwaway inboxes.

Each protection is built and maintained by Clerk. Manage them together on the Protections⁠ page in the Clerk Dashboard. We'll keep adding protections as we find new ways to protect your application.

Get started

Explore Protect in the Clerk Dashboard⁠ and choose the protections that fit your application. See the getting started guide for requirements and setup instructions.

Sometimes one person ends up with two users in your application. Maybe they signed up with a work email and later signed in with Google under a personal one, or they unintentionally signed up again with a subaddress like jane+work@example.com (and Block email subaddresses was not enabled). An administrator for your application can always clean this up by deleting one user and adding what it had to the other, but this is a manual process. It also often meant asking the person to redo their own setup, like re-connecting their Google account or enrolling their authenticator app again.

Now you can do it in one call. Use our Backend API to merge a user⁠ into another, and Clerk moves its email addresses, phone numbers, connected accounts, passkeys, TOTP, backup codes, organization memberships and metadata onto the user you keep, then deletes the duplicate. When both users have a value for the same field, such as a name, password, username, metadata key, or role in an organization, the user you keep retains its current value.

A few things to know:

• A merge can't be undone. Pass dry_run: true to see the merged user before committing to it.
• The response includes the deleted user as it was before the merge, and a new user.merged webhook links the two, so you can keep track of merges in your own backend. Each merge is also recorded as a user.merged event in Admin Logs and Application Logs.
• A merge isn't allowed if either user is managed by Directory Sync or if the user being deleted has an enterprise SSO account. If the Backend API rejects a merge, it returns the reasons.

Apps that don't use the native components no longer bundle the Clerk iOS and Android SDKs, and they no longer require iOS 17.

If you use <AuthView />, <UserButton />, or <UserProfileView />, install the package, rebuild your app, and update your imports:

npx expo install @clerk/expo-native-components

- import { AuthView, UserButton } from '@clerk/expo/native'
+ import { AuthView, UserButton } from '@clerk/expo/native-components'

The old @clerk/expo/native import path is deprecated and will be removed in the next major version.

Ship the new app binary before any over-the-air update that includes this change. Without the package, native components throw an error at runtime.

On Android, apps without the package no longer migrate biometric credentials enrolled with earlier versions of the SDK, so some users may need to enroll again.

This change is available in @clerk/expo 4.11.0. See the native components overview for setup.

To reduce the chance of a Secret key leaking, the API keys⁠ page in the Clerk Dashboard now shows its full value only when you add it. After that, it shows only part of each key, so you can match it to the one in your environment.

Code snippets that need a Secret key now let you add a new key without leaving the page.

Existing Secret keys keep working, and you don't need to rotate them. If you've lost a key you need, add a new one, then delete the old one once your code no longer uses it.

Clerk's MCP server now works with your Clerk account. Alongside SDK snippets and quickstarts, your agent can create applications, configure authentication, manage users, and set up production instances.

Connect your Clerk account through your MCP client's sign-in flow. Your agent can only do what you approve and what your workspace Role allows.

Example prompts

Try asking your agent:

• "List the five most recent sign-ups."
• "Which Clerk applications do I have?"
• "Show the authentication settings for the development instance."
• "Create a test user in the development instance."
• "Check which DNS records are required for production."

Get started

See the Clerk MCP server docs for setup steps and the full list of tools.