Clerk Changelog

You can now customize how long a successful sign-in or reverification remains valid for Clerk-protected sensitive actions. Set the reverification window between 1 and 10 minutes. The default remains 10 minutes.

A shorter window can prompt users to verify their credentials more often before actions such as changing a password, adding and removing an email address, revoking a session, or deleting an account.

To configure the window, open the Sessions⁠ page in the Clerk Dashboard. Under Session lifetime, set Reverification window to the number of minutes you want, between 1 and 10.

This setting applies to sensitive actions protected by Clerk. For sensitive actions unique to your application, define the required window in your application. See the reverification guide for details.

The Clerk Dashboard now has Admin Logs⁠: an audit trail of the configuration changes made across your workspace — from the Dashboard, the Backend API, or the Platform API. Admin Logs track actions like creating OAuth applications, updating instance settings, rotating secrets, and managing Roles and Permissions, and more.

Filtering and search

The logs page shows a reverse-chronological feed of events. Each entry lists a description of what happened (e.g., "Brandon Romano created a user"), the application it happened in (when applicable), the originating IP address with a country flag (when available), and the timestamp. Select any entry to see its full details.

You can narrow the feed with filters:

• Event type — Filter by event type (e.g., oauth_application.updated, domain.created). Supports trailing wildcards (e.g., oauth_application.*).
• Instance — Filter by the instance the action targeted.
• Application — Filter by the application the action targeted.
• Actor — Filter by the actor that triggered the event.
• IP address — Filter by the IP address the action originated from.
• Time range — Scope results to a specific time window.

Get started

Admin Logs are available on the Business and Enterprise plans — see the pricing page for details. They start recording on August 24, 2026; actions before that date aren't included. Open Admin Logs⁠ in the Clerk Dashboard, or read the docs.

Going forward

Admin Logs join Application Logs and Email Logs in Clerk's ongoing observability work.

Clerk now gives you finer control over the access that MCP clients can request from your API. Define custom OAuth scopes in the Clerk Dashboard to match the actions and resources your API supports.

For example:

• messages:read
• tools:execute
• resources/files:read
• mcp_all

Assign only the scopes that each OAuth application needs. Separately, choose which scopes to advertise through Clerk's OAuth metadata so MCP clients can discover what your application supports.

Open the Scopes tab on the OAuth applications⁠ page to get started.

To enforce scopes in your API, verify each OAuth access token and check its granted scopes. See Verify OAuth tokens with Clerk.

Clerk's mobile SDKs can now enroll a signed-in user's current device as a biometric credential, then let returning users sign in with Face ID, Touch ID, or Android biometrics. Clerk verifies a device-bound challenge while the private key stays on the device.

Prebuilt auth and user profile views can show the enrollment prompt, biometric sign-in button, and current-device toggle. Custom flows can use the biometric credential APIs directly.

Expo

import { useBiometricCredentials } from '@clerk/expo'

const { enroll } = useBiometricCredentials()

await enroll()

import { useBiometricCredentials } from '@clerk/expo'

const { signIn } = useBiometricCredentials()

await signIn()

import { useBiometricCredentials } from '@clerk/expo'

const { revoke } = useBiometricCredentials()

await revoke(biometricCredentialId)

iOS

try await Clerk.shared.biometricCredentials.enroll()

try await Clerk.shared.auth.signInWithBiometrics()

try await Clerk.shared.biometricCredentials.revoke(id: biometricCredentialId)

Android

scope.launch {
  Clerk.biometricCredentials.enroll()
}

scope.launch {
  Clerk.auth.signInWithBiometrics()
}

scope.launch {
  Clerk.biometricCredentials.revoke(biometricCredentialId)
}

See the biometric sign-in docs for setup and reference material:

• iOS guide
• Android guide
• Expo guide

Sometimes the list price isn't the right price. Sales closes a deal with a negotiated discount, you want to reward an early adopter, or you're running a launch promotion. Billing now supports discounts — apply them directly to a customer's subscription, or hand out a promo code customers redeem themselves at checkout.

Create a discount once, use it anywhere

Discounts are reusable and flexible:

• Percentage or fixed amount — take 20% off, or $50 off
• Any duration — a single billing cycle, a set number of cycles, or indefinitely
• Per-period amounts — different discount amounts for monthly and annual plans

Apply it yourself, or share a code

• Manual discounts — apply a discount to any subscriber's active subscription from the Dashboard. Revoke it at any time to return the subscription to its original price at the next renewal.
• Promo codes — publish a code (like LAUNCH20) that customers enter at checkout to redeem the discount themselves. Optionally cap the total number of redemptions, restrict redemption to new subscribers, and track how many times each code has been used.

Discounts and promo codes are available now for everyone using Clerk Billing. See the docs to get started.

Clerk's OAuth provider now supports Client ID Metadata Documents⁠ (CIMD), available today as a beta.

A compatible client uses an HTTPS URL as its client_id. Clerk fetches the metadata document at that URL and validates the client's identity and redirect URIs. This gives MCP and other public OAuth clients a stable identity without a pre-issued client ID, client secret, or Dynamic Client Registration.

Control which clients can connect

The new CIMD Clients tab on the OAuth applications⁠ page lets you:

• Explicitly allow a client by its Client ID URL and choose its scopes.
• Allow supported popular clients with suggested scopes.
• Review each client's admission status and metadata fetch health.
• Edit scopes, refresh metadata, or delete a saved client.
• Decide whether unknown clients may connect.
• Block clients that were implicitly allowed during an earlier connection.

Enable Advertise CIMD support to publish CIMD in your authorization server metadata. Once you do, any CIMD client can connect and Clerk records it when it first connects so you can review it later. Enable Only allow pre-registered clients to connect at the same time to restrict OAuth flows to clients you've reviewed in advance.

Get started

CIMD is currently available in beta. To try it, contact support⁠ to enable it for your workspace.

Read Manage OAuth clients with Client ID Metadata Documents to learn how CIMD works and how to configure client admission policies.

We'd love to hear your feedback as you try out CIMD. Your input during the beta period will help us refine the feature. Have questions or suggestions? Reach out through our feedback portal⁠ or join the discussion in our Discord community⁠.