Set up Protect

Clerk Protect runs inside Clerk's authentication flows. Applications that use Clerk's prebuilt components on current Clerk SDKs need no changes to their sign-up flow, though you might need to update your Content Security Policy. Before you enable a system protection, check the requirements. Then enable the protections you need in the Clerk Dashboard and test them in a development instance before enabling them in production.

Requirements

• ClerkJS 6.39.0 or later. Clerk's Core 3 SDKs, such as @clerk/nextjs 7 and @clerk/react 6, load the latest ClerkJS 6 automatically. Applications on older SDKs load ClerkJS 5 and need to upgrade to Core 3. If your application bundles @clerk/clerk-js instead of loading it from Clerk, update the package. To see which version your site runs, open it in a browser and run window.Clerk.version in the developer console.
• A Content Security Policy that allows Protect. If your application sets a Content Security Policy, add the directives in Configure Clerk Content-Security-Policy headers. They cover Device Intelligence and challenges.
• Support for challenges in custom sign-up flows. If you enable Challenge suspicious sign-ups with a custom sign-up flow⁠, your flow must be able to display a challenge. Clerk's prebuilt components do this automatically, but the Dashboard can't verify a custom flow. See Handle sign-up challenges in your custom flow.

For details on what each protection checks and requires, see Challenge suspicious sign-ups and Require Device Intelligence checks.

Enable protections

1. In the Clerk Dashboard, under Protect, navigate to the Protections⁠ page.
2. Find the protection's row and check its Status.
   • If Disabled, select Enable. In the dialog, toggle on Enable, then select Save.
   • If Enabled, the protection is already active. To disable it, select Manage, toggle off Enable, then select Save.
   • If Setup required, select Manage and complete the setup. Clerk loads your application and checks its ClerkJS version and Content Security Policy against the requirements before you can enable any protection. If the check can't reach your application, such as one running on your machine, confirm the requirements yourself and select Bypass checks. This can't be undone.

Test protections before production

Each instance has separate protection settings. Enable a protection in your development instance, test a sign-up from a browser, and review any Protect events in Application Logs before you enable it in production.