Require Device Intelligence checks

Scripts that create fake accounts in bulk often send sign-up requests straight to Clerk instead of loading your sign-up page in a real browser, so ClerkJS never runs for them. Require Device Intelligence checks blocks a sign-up created by a browser for which Clerk has no verified Device Intelligence result. ClerkJS runs Device Intelligence checks in the background; the checks don't block sign-ups on their own.

What it blocks

A sign-up from a browser is blocked when Clerk has no verified Device Intelligence result for that browser at the moment the sign-up is created. Clerk checks once, at creation. Later steps, such as entering a verification code, aren't checked.

The protection applies to sign-ups from browsers only:

• It never checks a sign-in, so it doesn't stop existing users from signing in.
• Sign-ups from native apps built with Clerk iOS, Android, and Expo SDKs aren't affected.

What happens when a sign-up is blocked

The account isn't created, and the user sees a message that they can't sign up. See What blocked users see.

Each blocked sign-up appears as a protect.sign_up.blocked event in Application Logs.

Device Intelligence

Device Intelligence is a set of background checks that ClerkJS runs in the browser, and that Clerk verifies. They add no visible step during sign-up.

Clerk enables Device Intelligence automatically when you create an application, or when your application passes or bypasses the requirements check in the Clerk Dashboard. It has no Dashboard setting. To disable it, first disable Require Device Intelligence checks, then contact support. Without Device Intelligence, this protection blocks every browser sign-up.

Settings

This protection has no settings.

Before you enable it

• If Device Intelligence can't run, every browser sign-up is blocked. That happens if Device Intelligence isn't enabled or your Content Security Policy blocks it. Users on a ClerkJS too old to run Device Intelligence are blocked too. Enable this protection in your development instance first, then sign up from a browser yourself before you enable it in production.
• Check your automated tests. Testing Tokens don't skip this check. End-to-end tests that drive a real browser, such as Playwright or Cypress, run the check the same way your users' browsers do, so they need to meet the same requirements.