Challenges

When a protection challenges an attempt, the user completes an additional verification step before their sign-up can continue. Challenges let Protect slow down suspicious traffic without blocking it outright. Most real users get through without doing anything, and automated traffic has to get past the check too.

The challenge experience

The challenge appears directly in the sign-up flow. Most people pass it without doing anything. Some are asked to complete a short verification step. Either way, their attempt then continues normally.

Challenge residential proxies uses a different kind of challenge: an automatic check in the browser, with nothing to solve. It takes from a few seconds on a fast connection to a minute or more on a slow one.

Integration requirements

• Prebuilt components: Clerk's prebuilt components render challenges automatically on ClerkJS 6.39.0 or later. No integration work is required.
• Custom flows: If your application uses custom flows, ClerkJS shows the challenge in a dialog over your page, and your flow has to meet a few requirements. See Handle sign-up challenges in your custom flow.
• Native apps: Clerk's native SDKs for iOS, Android, and Expo can't show a challenge yet. A protection that would challenge a sign-up from a native app lets it through instead; protections that block still apply. See Native apps.

Protections that challenge

• Challenge suspicious sign-ups
• Challenge residential proxies

When a challenge fails

If a challenge isn't completed, the attempt doesn't proceed.

Native API and CAPTCHA

The Native API⁠ setting allows native applications and browser extensions to make requests to Clerk in environments that cannot always complete a browser-based CAPTCHA challenge. It enables a public request pathway through which CAPTCHA challenges are bypassed, even when legacy bot sign-up protection is on. Challenge suspicious sign-ups also doesn't challenge sign-ups from native applications while the Native API is enabled. While it's disabled, Clerk rejects every request from a native application with a native_api_disabled error, so a native sign-up fails instead of being challenged. Clerk's standard browser-based authentication flows continue to use CAPTCHA when a challenge is required.

Only enable the Native API when your native application or browser extension requires it. Because the pathway is public, it must not be treated as a secret or used as the only boundary protecting your application from automated traffic. Registering an application's bundle identifier or package name allows Clerk to validate callbacks for supported native authentication flows, but does not make the Native API pathway private.