Require Device Intelligence checks

Scripts that create fake accounts in bulk often send sign-up requests straight to Clerk instead of loading your sign-up page in a real browser, so ClerkJS never runs for them. Require Device Intelligence checks blocks a sign-up created by a browser for which Clerk has no verified Device Intelligence result. ClerkJS runs Device Intelligence checks in the background; the checks don't block sign-ups on their own.

What it blocks

A sign-up from a browser is blocked when Clerk has no verified Device Intelligence result for that browser at the moment the sign-up is created. Clerk checks once, at creation. Later steps, such as entering a verification code, aren't checked. A sign-up that carries a valid Testing Token isn't checked.

The protection applies to sign-ups from browsers only:

• It never checks a sign-in, so it doesn't stop existing users from signing in.
• Sign-ups from native apps built with Clerk iOS, Android, and Expo SDKs aren't affected.

What happens when a sign-up is blocked

The account isn't created, and the user sees a message that they can't sign up. See What blocked users see.

Each blocked sign-up appears as a protect.sign_up.blocked event in Application Logs.

Device Intelligence

Device Intelligence is a set of background checks that ClerkJS runs in the browser, and that Clerk verifies. They add no visible step during sign-up.

Clerk enables Device Intelligence automatically when you create an application, or when your application passes or bypasses the requirements check in the Clerk Dashboard. It has no Dashboard setting. To disable it, first disable Require Device Intelligence checks, then contact support. Without Device Intelligence, this protection blocks every browser sign-up that doesn't carry a valid Testing Token.

Settings

This protection has no settings.

If it's already on

Each instance gets its default protections when you create it. This protection is on in every instance created on or after October 27, 2026, except a production instance created with Clone development instance, which takes its settings from your development instance. So if you created your application before that date and now create its production instance with Create default instance, this protection is on in production but not in development.

The Protections⁠ page shows it as enabled whether or not your application meets the requirements. In each instance that has it on, sign up from a browser without a Testing Token to confirm that Device Intelligence runs. If it doesn't, turn the protection off there until you fix the cause.

Before you enable it

• Test it in development first. Device Intelligence can't run if it isn't enabled, your Content Security Policy blocks it, or a user's ClerkJS is too old. When it can't run, Require Device Intelligence checks blocks every browser sign-up without a valid Testing Token. Enable it in your development instance and sign up from a browser yourself before you enable it in production.
• Use Testing Tokens in your automated tests. A sign-up that carries a valid Testing Token isn't checked, so end-to-end tests keep running when their browser can't run Device Intelligence. Tests that don't use one are checked like any other browser sign-up, so they need to meet the same requirements.