Require a minimum ClerkJS version

The protections that block or challenge need a recent version of ClerkJS. On an older version, a sign-up that one of them challenges can stop without an error. Attempts from an older version come from an app that hasn't upgraded, or from a script built on an old copy of ClerkJS. Require a minimum ClerkJS version blocks sign-ups and sign-ins from versions older than the minimum you set, with a message that tells the developer to upgrade.

What it blocks

A sign-up or sign-in is blocked when it comes from a ClerkJS version older than the Minimum ClerkJS version setting. A sign-up or sign-in that carries a valid Testing Token isn't checked.

Sign-ups and sign-ins from native apps built with Clerk's iOS, Android, and Expo SDKs aren't affected.

What happens when an attempt is blocked

The sign-up or sign-in doesn't go through, and the user sees a message that the app uses an outdated version of Clerk. The message is written for the app's developer, in case the app itself is what's outdated. In English, the title and message are:

Prebuilt components on current SDK versions show the title and message on a full screen, with a link to Clerk's upgrade guides and a reference code. Older SDKs, including ClerkJS 5, show a shorter error instead. See What blocked users see.

Each blocked attempt appears as a protect.sign_up.blocked or protect.sign_in.blocked event in Application Logs.

Settings

Choose a minimum

Set the minimum no higher than the version your deployed app runs. Above that, this protection blocks your own users. A new ClerkJS release doesn't reach your app right away, so check before you raise the minimum. To check your app's version, open your browser's console and run window.Clerk.version.

How it works with other protections

With the default minimum, this protection blocks every ClerkJS version too old for the other protections that block or challenge. See the requirements.

It doesn't look at who's behind an attempt, so use it alongside the protections that target bots and fake accounts, such as Challenge suspicious sign-ups and Require Device Intelligence checks.

Before you enable it

• Upgrade your app first. Apps on a Core 2 SDK run ClerkJS 5, which is older than the default minimum, so follow the Core 3 upgrade guide. If you bundle or host @clerk/clerk-js yourself, update it.
• Test it in development first. Enable it in your development instance, then sign up and sign in from a browser yourself before you enable it in production. Automated tests that use a Testing Token skip this protection, so they pass when your app runs an outdated version.