# Clerk Glossary (index)

> Index of every Clerk glossary entry. Each entry links to the full entry on clerk.com.

## Companion files

- [Clerk root index](https://clerk.com/llms.txt): Top-level Clerk index for LLMs and agents
- [Articles index](https://clerk.com/articles/llms.txt): Index of every Clerk article
- [Blog index](https://clerk.com/blog/llms.txt): Index of every Clerk blog post
- [Changelog index](https://clerk.com/changelog/llms.txt): Index of every Clerk changelog entry
- [Dashboard index](https://dashboard.clerk.com/llms.txt): Index of the Clerk Dashboard for LLMs and agents

---

- [Access Control List (ACL)](https://clerk.com/glossary.md#access-control-list-acl): An access control list (ACL) is a resource-scoped policy that lists which principals (users, groups, service accounts) have which permissions on that resource. Each access control entry (ACE) names a subject and a set of allowed or denied actions (`read`, `write`, `execute`, `delete`), optionally with inheritance. At request time, the system resolves the caller and evaluates ACEs in a defined order with default-deny. ACLs are fine-grained but resource-scoped and hard to operate across thousands or millions of resources, causing many teams to adopt [RBAC](https://clerk.com/blog/role-based-access-control-with-clerk-orgs.md) or [ABAC](https://clerk.com/blog/authentication-vs-authorization.md).
- [Access Token](https://clerk.com/glossary.md#access-token): An Access Token is a credential used to access protected resources in an API, typically issued by an authorization server and used in OAuth and OpenID Connect protocols.
- [Account Linking](https://clerk.com/glossary.md#account-linking): Account Linking is the process of connecting multiple user accounts from different services or platforms, allowing users to access various services with a single set of credentials.
- [Account Portal](https://clerk.com/glossary.md#account-portal): An Account Portal is a user interface that allows users to manage their account settings, personal information, and preferences within an application.
- [Account Protection](https://clerk.com/glossary.md#account-protection): Account protection encompasses the security measures and strategies used to prevent unauthorized access to user accounts, including multi-factor authentication, bot detection, brute force prevention, and credential stuffing mitigation.
- [Account Recovery](https://clerk.com/glossary.md#account-recovery): Account recovery refers to controlled verification flows that let a legitimate user regain access to their account when primary factors are lost or unavailable—typically via OTP, email link, backup/recovery codes, a trusted device, or passkey recovery.
- [Account Security](https://clerk.com/glossary.md#account-security): Account security refers to the practices and technologies that safeguard user accounts from compromise, including strong authentication methods, session management, and proactive threat detection.
- [Account Takeover](https://clerk.com/glossary.md#account-takeover): An Account Takeover refer to the unauthorized access and control of a user’s account by malicious actors. This security breach often involves exploiting weak passwords, phishing attacks, or other vulnerabilities to gain access to personal information, financial data, or other sensitive content. Preventing account takeovers is crucial for maintaining user trust and safeguarding data integrity.
- [Action Function](https://clerk.com/glossary.md#action-function): An Action Function is a function that handles user actions, such as form submissions or button clicks, often performing tasks like data processing or API calls.
- [Active Device Monitoring](https://clerk.com/glossary.md#active-device-monitoring): Active Device Monitoring is a continuous security practice that involves tracking and analyzing the behavior of devices connected to a network. This technique helps in identifying suspicious activities, unauthorized access attempts, and potential security threats in real-time. Implementing active device monitoring enhances the overall security posture by ensuring only trusted devices can access sensitive information.
- [Admin Dashboard](https://clerk.com/glossary.md#admin-dashboard): An Admin Dashboard is a user interface that provides administrators with access to various tools and data for managing and monitoring an application, including user management, analytics, and settings.
- [Aggregated Claims](https://clerk.com/glossary.md#aggregated-claims): Aggregated claims in OIDC are third-party user claims that the OpenID Provider returns inside UserInfo as an embedded, signed JWT. The response includes `_claim_names` and `_claim_sources` to show which claims came from which external issuer. The client validates that embedded JWT and then uses the claims, no extra fetch required.
- [AI Authentication](https://clerk.com/glossary.md#ai-authentication): AI Authentication leverages artificial intelligence to enhance the security and efficiency of the authentication process. By analyzing patterns, behaviors, and biometric data, AI authentication can provide a more secure and seamless user experience. This advanced method reduces the risk of fraud and unauthorized access by continuously learning and adapting to new threats.
- [Allowlist/Blocklist](https://clerk.com/glossary.md#allowlist-denylist): Allowlist/Blocklist (also called Denylist) are explicit sets of permitted or blocked values (e.g., emails, domains, phone numbers, Web3 addresses) enforced at sensitive points like sign-up and sign-in. It's good practice to adopt a default-deny stance (permit only allowlisted values) and reserve the blocklist for explicit hard blocks.
- [API Authentication](https://clerk.com/glossary.md#api-authentication): API authentication is the process of verifying the identity of a client — whether a user, application, or service — before granting access to an API's protected resources. Unlike browser-based authentication, which typically relies on sessions and cookies, API authentication is usually stateless: credentials or tokens are sent with every request, most commonly in the HTTP Authorization header. Common methods include API keys, HTTP Basic Authentication, Bearer tokens (often JWTs), and OAuth 2.0 flows. API authentication confirms who is making the request; API authorization then determines what that caller is permitted to do. Choosing the right method depends on the trust model — API keys suit simple server-to-server identification, while OAuth 2.0 is better suited for delegated access on behalf of a user.
- [API Gateway](https://clerk.com/glossary.md#api-gateway): An API gateway centralizes request routing to backend services, rate limiting, caching, and TLS termination. In auth contexts, it verifies tokens and applies per-route policies. Note: Clerk is not an API gateway but provides authentication middleware that integrates with API gateways to handle JWT verification and authorization checks.
- [API Integration](https://clerk.com/glossary.md#api-integration): API integration is the process of connecting different software systems through their application programming interfaces, enabling them to exchange data and functionality seamlessly.
- [API Key](https://clerk.com/glossary/api-key.md): An API Key is a unique identifier used to authenticate a user, developer, or calling program to an API (Application Programming Interface). API keys are essential for controlling access to the API, tracking usage, and preventing unauthorized access. Proper management and security of API keys are critical to protect sensitive data and maintain the integrity of the API.
- [API Rate Limits](https://clerk.com/glossary.md#api-rate-limits): API rate limits are policies that cap the volume of requests a client (application, user, IP, etc.) can send to specific API endpoints over a defined time interval. Limits may be per token / API key, IP address, user account, or tenant (or a combination).
- [API Security](https://clerk.com/glossary.md#api-security): API security encompasses the practices and tools used to protect application programming interfaces from unauthorized access, data breaches, and abuse, including authentication, rate limiting, and encryption.
- [API Testing](https://clerk.com/glossary.md#api-testing): API testing is the process of verifying that application programming interfaces function correctly, securely, and performantly, often using specialized tokens and tools to simulate authenticated requests.
- [App Router](https://clerk.com/glossary/app-router.md): An App Router is a routing system in a web application framework that manages the navigation and rendering of different views or pages based on URL paths.
- [Application Architecture](https://clerk.com/glossary.md#application-architecture): Application architecture defines the structural design of a software application, including how components are organized, how data flows between layers, and how concerns like authentication, routing, and data access are separated.
- [Application Programming Interface](https://clerk.com/glossary.md#application-programming-interface): An Application Programming Interface (API) is a set of rules and protocols that allows different software applications to communicate with each other, enabling integration and data exchange.
- [Artificial Intelligence (AI)](https://clerk.com/glossary.md#artificial-intelligence-ai): Artificial Intelligence (AI) refers to the simulation of human intelligence in machines that are programmed to think, learn, and perform tasks typically requiring human intelligence. AI encompasses a variety of technologies, including machine learning, natural language processing, and robotics. In web development and security, AI is used to enhance user experiences, automate processes, and improve threat detection.
- [Assertion Consumer Service (ACS)](https://clerk.com/glossary.md#assertion-consumer-service-acs): Assertion Consumer Service (ACS) is a service-provider endpoint that receives SAML assertions from the identity provider. It validates signature, audience, issuer, and time bounds before a session is established.
- [Attribute Mapping](https://clerk.com/glossary.md#attribute-mapping): Attribute mapping translates identity data from an external IdP into Clerk's user schema. During SAML/OIDC sign-in or JIT provisioning, incoming attributes (e.g., `email`, `given_name`, `family_name`) are mapped to Clerk User properties. Additional claims can be mapped to `publicMetadata` by prepending `public_metadata_`. Clerk also allows setting default values for missing claims when IdPs return non-standard formats.
- [Audit Logs](https://clerk.com/glossary.md#audit-logs): Audit Logs are records of security-relevant events (sign-ins, factor changes, role edits, administrative actions) that are timestamped, immutable, and can be queried for investigation and compliance purposes. In Clerk, making [authenticated requests](https://clerk.com/docs/reference/backend/overview.md) to the backend enables you to keep an audit log of which device the user is performing actions from.
- [Authentication](https://clerk.com/glossary.md#authentication): Authentication — sometimes abbreviated as authn — is the process of verifying the identity of a user, device, or application before granting access to a system or resource. This critical security measure ensures that only authorized individuals can access sensitive information. Authentication methods can include passwords, biometrics, tokens, and multi-factor authentication (MFA) to enhance security and user trust.
- [Authentication Challenge](https://clerk.com/glossary.md#authentication-challenge): An Authentication Challenge is a request for additional verification during the authentication process, often used in multi-factor authentication to ensure the user’s identity.
- [Authentication Context](https://clerk.com/glossary.md#authentication-context): In Clerk, authentication context includes session information like user ID, organization, and factor verification freshness. The `fva` (factor verification age) array tracks how long since each factor was verified. Clerk supports reverification policies (`strict`, `moderate`, `lax`) to require re-authentication before sensitive actions based on time since last verification. Note: Clerk uses proprietary claims instead of standard OIDC `amr`/`acr`/`auth_time` or SAML `AuthnContextClassRef`.
- [Authentication Methods](https://clerk.com/glossary.md#authentication-methods): Authentication methods are the factors and protocols used to verify a user's identity. They fall into five categories: knowledge ("something you know" — passwords, security questions), possession ("something you have" — passcodes, hardware keys), inherence ("something you are" — biometrics), location, and behavior. Modern apps combine methods (MFA) for stronger security. Clerk supports passwords, passkeys, OAuth, magic links, SMS, TOTP, and biometrics in a single auth flow.
- [Authenticator Apps (TOTP)](https://clerk.com/glossary.md#authenticator-apps-totp): Authenticator Apps using TOTP (Time-Based One-Time Password) generate temporary, time-sensitive passcodes used for two-factor authentication (2FA). These apps, such as Google Authenticator or Authy, provide an additional layer of security by requiring users to enter a code from the app in addition to their password. This method significantly reduces the risk of unauthorized access by ensuring that only users with access to the physical device can log in.
- [Authn](https://clerk.com/glossary.md#authn): Authn is developer shorthand for authentication — the process of verifying who a user, device, or application is before granting access to a system. The abbreviation comes from cryptographic and identity literature, where it's paired with authz (authorization) to clarify which half of the access-control problem is being discussed. Authn answers "who is this?"; authz answers "what can they do?"
- [Authorization](https://clerk.com/glossary.md#authorization): Authorization — sometimes abbreviated as authz — is the process of determining what an authenticated user, device, or application is allowed to access or do within a system. While authentication verifies who you are, authorization determines what you're permitted to do. Authentication always happens first; authorization follows. In practice, authorization is enforced through models like Role-Based Access Control (RBAC), Attribute-Based Access Control (ABAC), and Access Control Lists (ACLs), or via OAuth scopes and claims embedded in access tokens. These policies are evaluated at request time — in middleware, API gateways, or application logic — to grant or deny access to specific resources or actions.
- [Authorization Code Flow](https://clerk.com/glossary.md#authorization-code-flow): Authorization Code Flow is Clerk's recommended OAuth 2.0 flow for web and mobile applications. Users authenticate through Clerk's hosted UI, which then redirects them back to your application's registered callback URL with a temporary authorization code appended as a query parameter. Your backend extracts this code from the redirect and exchanges it server-side for access and ID tokens, keeping credentials secure and out of browser history. PKCE is required for client-side apps to prevent authorization code interception.
- [Authorization Server](https://clerk.com/glossary.md#authorization-server): An Authorization Server is the OAuth 2.0/OpenID Connect component responsible for authenticating users (or delegating authentication), obtaining authorization consent, and issuing security tokens. It exposes standardized endpoints (`/authorize`, `/token`, `/userinfo`, `/revoke`, `/introspect`) that clients use to initiate authorization flows, exchange authorization codes for tokens, and manage token lifecycles. The authorization server determines token claims and permissions via scopes, enforces security policies, and issues access tokens, ID tokens, and refresh tokens with configurable expiration times. In Clerk, Clerk functions as your authorization server.
- [Authz](https://clerk.com/glossary.md#authz): Authz is developer shorthand for authorization — the process of determining what an authenticated user, device, or application is allowed to do. Paired with authn (authentication), the abbreviation distinguishes "what can they do?" from "who is this?". Authz is enforced through models like Role-Based Access Control (RBAC), Attribute-Based Access Control (ABAC), and Access Control Lists (ACLs).
- [Automation](https://clerk.com/glossary.md#automation): Automation in software systems refers to the use of programmatic triggers, webhooks, and scheduled processes to perform tasks without manual intervention, such as syncing user directories or processing authentication events.
- [B2B SSO](https://clerk.com/glossary.md#b2b-sso): B2B single sign-on (SSO) enables multi-tenant applications where each customer organization connects its own identity provider (IdP) to your app via SAML or OpenID Connect (OIDC). Users redirect to their organization's IdP for authentication, which returns a signed assertion/token containing user attributes and group memberships. Your app validates the signature, maps groups to roles, and provisions accounts automatically via just-in-time (JIT) provisioning, with SCIM available for full lifecycle management. This gives enterprise customers centralized access control while providing seamless login experiences.
- [Back-Channel Logout](https://clerk.com/glossary.md#back-channel-logout): Back-Channel Logout is an OpenID Connect server-to-server logout method where the Identity Provider directly notifies each Relying Party's logout endpoint with a signed JWT logout token when a user signs out. Relying Parties verify the signature and terminate sessions without browser involvement. More reliable than front-channel logout because it works even if the browser is closed, JavaScript is blocked, or network connectivity is lost.
- [Backend as a Service (BaaS)](https://clerk.com/glossary.md#backend-as-a-service-baas): Backend as a Service (BaaS) is a cloud computing model that provides developers with pre-built backend infrastructure including databases, authentication, and APIs, reducing the need to manage server-side code and infrastructure.
- [Backend Development](https://clerk.com/glossary.md#backend-development): Backend development involves building and maintaining the server-side logic, databases, and APIs that power web and mobile applications, handling tasks like authentication, data processing, and business logic.
- [Backoff/Retry Policy](https://clerk.com/glossary.md#backoff-retry-policy): A Backoff/Retry Policy defines rules for automatically retrying failed API requests to authentication services. When requests fail due to transient issues (network timeouts, server overload, rate limits), the policy determines whether to retry, how long to wait, and how many attempts to make. Standard implementations use exponential backoff with jitter—doubling the wait time between attempts (1s, 2s, 4s, 8s) with random delays to prevent synchronized retry storms—typically limiting to 3-5 total attempts. Policies only retry transient errors (5xx server errors, 429 rate limits, timeouts) and fail immediately on permanent errors (401 unauthorized, 400 bad request). This ensures legitimate requests eventually succeed while preventing service overload.
- [Backup Codes](https://clerk.com/glossary.md#backup-codes): Backup Codes are single-use recovery codes generated during MFA enrollment that allow account access when primary factors (authenticator app, SMS) are unavailable. Users receive 8-10 codes to store securely, as they bypass MFA verification. Can be regenerated anytime, invalidating previous codes.
- [Bearer Token](https://clerk.com/glossary.md#bearer-token): A bearer token — also called token authentication — is an access credential where possession alone grants authorization: any party that presents the token can use it to access protected resources, without proving ownership of a cryptographic key. Bearer tokens are the predominant access token type in OAuth 2.0, defined in RFC 6750, and are sent in the HTTP Authorization header as `Authorization: Bearer <token>`. The token itself may be an opaque string or a structured JSON Web Token (JWT). Because anyone with the token can use it, bearer tokens require HTTPS transport, short expiration times, and narrow scopes to limit exposure risk. This distinguishes them from proof-of-possession tokens (such as DPoP), which cryptographically bind the token to a specific client.
- [Biometric Authentication](https://clerk.com/glossary.md#biometric-authentication): Biometric authentication verifies users by measuring unique physical or behavioral traits (fingerprint, face, voice) and comparing them to stored templates. Modern implementations process biometrics locally in secure hardware with liveness detection to prevent spoofing. Best used to unlock cryptographic keys—such as passkeys via WebAuthn—rather than transmitting to servers. Unlike passwords, biometrics cannot be changed if compromised, making secure local storage and fallback authentication methods essential.
- [Bot Detection](https://clerk.com/glossary.md#bot-detection): Bot Detection identifies and blocks automated attacks on authentication systems—such as credential stuffing, brute force login attempts, and fake account creation—while allowing legitimate automated traffic like search crawlers. Techniques include IP reputation analysis, behavioral patterns (mouse movement, typing cadence), rate limiting, device fingerprinting, and challenge mechanisms like CAPTCHAs. Critical for protecting login endpoints and preventing account takeover attacks.
- [Browser Fingerprinting](https://clerk.com/glossary.md#browser-fingerprinting-advanced): Browser Fingerprinting is a technique that derives a likely-unique identifier from a device's and browser's characteristics (e.g., user agent, screen size, fonts, canvas/WebGL output, plugins, GPU) to recognize repeat visitors. It can persist across cookie clears and is used for fraud prevention and tracking, but accuracy varies and it is constrained by privacy controls and changing client signals.
- [Browser Sessions](https://clerk.com/glossary.md#browser-sessions): Browser sessions and application sessions are distinct concepts often confused in authentication. A browser session is the browser's native lifetime for a tab/window—storing session cookies (no expiration set), `sessionStorage`, and in-memory data that typically clear when all windows close. An application session is your app's authenticated state, tracked independently via session cookies or tokens with explicit security policies: idle timeouts, absolute expiration, rotation, and per-device isolation. Understanding this distinction is critical—application sessions must be managed by your authentication logic, not reliant on browser session behavior.
- [Browser Storage](https://clerk.com/glossary.md#browser-storage-local-session): Browser storage is the set of ways a website can store data on the user's device for a specific origin. It includes cookies (sent with requests; configurable via `Secure`, `HttpOnly`, `SameSite`), Web Storage (`localStorage` and `sessionStorage` for synchronous key-value data not sent with HTTP), `IndexedDB` (asynchronous, large structured data), and Cache Storage (request/response pairs via service workers). Choose storage based on payload size, access pattern (sync vs async), and data retention. Do not store long-lived secrets in JavaScript-accessible storage; put session tokens in `Secure`, `HttpOnly` cookies.
- [Brute Force Detection](https://clerk.com/glossary.md#brute-force-detection): Brute Force Detection is the practice of identifying and preventing repeated attempts to guess user credentials by monitoring login attempts and blocking suspicious activities to enhance security.
- [BYOK (Bring Your Own Key)](https://clerk.com/glossary.md#byok-bring-your-own-key): BYOK (Bring Your Own Key) is a key management model where the customer generates and controls the encryption key used to protect their data, rather than the service provider. The organization is responsible for key creation, rotation, revocation, and deletion, providing stronger assurance that only they can decrypt their data.
- [California Consumer Privacy Act (CCPA)](https://clerk.com/glossary.md#california-consumer-privacy-act-ccpa): The California Consumer Privacy Act (CCPA) is a state law that grants California residents new rights regarding their personal information, including the right to know, delete, and opt-out of the sale of their data.
- [CAPTCHA](https://clerk.com/glossary/captcha.md): CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is a security measure used to differentiate between human users and automated bots, often by presenting challenges that are easy for humans but difficult for bots.
- [Certificate Pinning](https://clerk.com/glossary.md#certificate-pinning): Certificate Pinning is a security technique in which a client (e.g. mobile app or service) pins a known certificate or public key to a server and rejects TLS/SSL connections that present anything else. It helps prevent man-in-the-middle attacks using fraudulent or misissued certificates, though it can break connectivity if the server's certificate changes without updating the pin.
- [Challenge–Response](https://clerk.com/glossary.md#challenge-response): Challenge–response is an authentication pattern where the server sends a fresh, unpredictable challenge (nonce) and the client returns a response computed with a secret or private key (for example, an HMAC or a digital signature). The server verifies the response to confirm possession of the credential without ever transmitting the secret. This resists replay and eavesdropping; examples include WebAuthn/passkeys (the authenticator signs the server challenge with origin binding) and SCRAM/HTTP Digest. To stay secure, challenges must be unique, time-bound, and tied to the session or origin to prevent reuse or relay.
- [Cipher Suite](https://clerk.com/glossary/cipher-suite.md): A cipher suite is a named combination of cryptographic algorithms that a client and server agree on during a TLS handshake, defining how they exchange keys, authenticate the connection, and encrypt and integrity-check the data sent between them.
- [Claim](https://clerk.com/glossary.md#claim): A claim represents a piece of information about a user or entity that is encoded within a JSON Web Token (JWT). When a token is created, claims are added to provide specific details about the token's subject, such as user ID, permissions, or expiration time. Claims are typically key-value pairs that describe attributes of the authenticated entity. The claims are digitally signed as part of the token, ensuring they cannot be altered without invalidating the token. One JWT can, and typically does, contain multiple claims that provide different types of information about the user or session.
- [Claims Transformation](https://clerk.com/glossary.md#claims-transformation): Claims Transformation is the process of mapping attributes or claims issued by an identity provider (IdP) or external system into the schema or fields your application consumes (for example, translating `groups` into `departments`). Transformation rules are deterministic and maintain the provenance of each mapped attribute, so you can trace where each output came from.
- [ClerkProvider](https://clerk.com/glossary.md#clerkprovider): ClerkProvider is a component in Clerk’s authentication library that wraps the application, providing context and configuration for authentication and user management.
- [Client Credentials Flow](https://clerk.com/glossary.md#client-credentials-flow): The Client Credentials Flow is an OAuth 2.0 grant for machine-to-machine (M2M) authentication, where a client (e.g. backend service or daemon) authenticates on its own behalf rather than on behalf of a user. The client sends credentials (such as `client_id` and `client_secret`) to the token endpoint and receives an access token, which it then uses to call APIs or services under its own identity.
- [Client ID Metadata Documents (CIMD)](https://clerk.com/glossary.md#client-id-metadata-documents): Client ID Metadata Documents (CIMD) is an OAuth extension that lets a client use an HTTPS URL as its `client_id`. The URL serves a JSON document that describes the client, including its name, logo, and allowed redirect URIs, so an authorization server can fetch it to identify the client without a pre-issued client ID, client secret, or Dynamic Client Registration. CIMD clients are public clients: they authenticate with PKCE rather than a secret, and the authorization server controls which clients may connect and which scopes they may request. This gives applications such as MCP clients a stable, verifiable identity across every authorization server they connect to.
- [Client Secret](https://clerk.com/glossary.md#client-secret): A `client_secret` is a confidential credential issued to an OAuth confidential client and known only to that client and the authorization server. The client presents it when authenticating at the token endpoint (and sometimes at introspection or revocation endpoints) using methods like `client_secret_basic` or `client_secret_post`. It's best practice to store secrets server-side (for example, in a secret manager) and rotate them regularly, especially since SPAs and native mobile apps expose their code and storage and thus can't truly keep secrets. For such public clients, you should not issue a `client_secret`; instead register them as public clients and use the Authorization Code flow with PKCE. In Clerk, setting up OAuth/Social Connections is straightforward: you enter your external `client_id` and `client_secret` in the Clerk dashboard, and Clerk handles the token exchange for you (so you don't have to write and manage boilerplate code).
- [Client-Side Routing](https://clerk.com/glossary.md#client-side-routing): Client-side routing is a technique where navigation between pages or views is handled entirely in the browser using JavaScript, without requiring full page reloads from the server.
- [Cloud Services](https://clerk.com/glossary.md#cloud-services): Cloud services are computing resources and platforms delivered over the internet, providing scalable infrastructure, databases, authentication, and other backend capabilities without requiring on-premise hardware management.
- [CNAME / Custom Domains](https://clerk.com/glossary.md#cname-custom-domains-auth): CNAME / Custom Domains let an organization map a subdomain they control (e.g. `auth.example.com`) to a vendor-hosted service so authentication pages and API endpoints appear under the organization's domain. To do this, you create a DNS `CNAME` record pointing that subdomain to the vendor's domain. Adding a custom domain (e.g. `auth.myapp.com`) to Clerk is straightforward: you just need to create a `CNAME` record pointing that subdomain to Clerk's provided domain, then Clerk handles verification, TLS certificate provisioning, and routes the traffic so authentication flows use your custom domain seamlessly. However, `CNAME` records can't be placed on a root (apex) domain, so many DNS providers support `ALIAS` or `ANAME` records (or use `A`/`AAAA` records) to achieve the same aliasing behavior at the apex.
- [Code Exchange (PKCE)](https://clerk.com/glossary.md#code-exchange-pkce): PKCE (Proof Key for Code Exchange) is an OAuth 2.0 extension that binds an authorization code to the specific client instance using a one-time `code_verifier` and its hashed `code_challenge` (`S256`). The client sends the challenge in the authorization request and later presents the verifier at the token endpoint; the server then recomputes and matches before issuing tokens, which blocks code interception and replay. PKCE is required for public clients like SPAs and mobile apps, and recommended for all clients using the Authorization Code flow.
- [Component Library](https://clerk.com/glossary.md#component-library): A Component Library is a collection of reusable UI components that developers can use to build applications, ensuring consistency, efficiency, and ease of maintenance in the development process.
- [Conditional Access](https://clerk.com/glossary.md#conditional-access): Conditional Access is a policy-based access control pattern that evaluates runtime context to decide whether to allow access, deny, or require additional verification from the user. Policies ingest signals such as user or group membership, role, device compliance, location or network, application sensitivity, and risk scores. Based on these signals, the system can require MFA, block noncompliant devices, limit session scopes or lifetimes, force reauthentication for sensitive operations, or deny access outright. Policies are typically expressed as simple "if–then" rules and can trigger both at initial sign-in and at step-up moments within the application.
- [Consent Screen](https://clerk.com/glossary.md#consent-screen): A Consent Screen (also called a permissions prompt or authorization interface) is the UI presented during an OAuth/OIDC flow that asks a user to approve the scopes or permissions an application is requesting. It shows what data or actions will be accessed (like profile, email, read/write), who is requesting access, and gives a clear option to accept or deny. The purpose is to ensure transparency and let users make informed decisions. Consent screens can appear at first sign-in or whenever app requests change (new scopes), and for trusted or first-party apps it may sometimes be possible to skip.
- [Content Security Policy (CSP)](https://clerk.com/glossary.md#content-security-policy-csp): Content Security Policy is a browser-security standard (via HTTP headers or meta tags) that tells the browser which sources of content are allowed on a page or app. It defines directives such as `script-src`, `img-src`, `style-src`, etc., which specify trusted origins or allowlists for different content types. CSP helps prevent attacks like Cross-Site Scripting (XSS), data injection, or clickjacking by rejecting or blocking content from untrusted sources. A policy can run in enforcement mode (blocking violations) or report-only mode (just logging them) to help test without breaking functionality.
- [Control Components](https://clerk.com/glossary.md#control-components): Control Components are components in a user interface that manage user input and interactions, such as buttons, forms, and sliders.
- [Convex](https://clerk.com/glossary.md#convex): Convex is a backend platform that provides real-time data synchronization and serverless functions, enabling developers to build dynamic and responsive web applications.
- [Credential Management API](https://clerk.com/glossary.md#credential-management-api): The Credential Management API is a browser standard (accessible via `navigator.credentials`) that lets websites programmatically create, store, retrieve, and use credentials, such as username/password, federated login, OTPs, or public-key credentials. It helps lower friction in cross-platform sign-in flows (e.g. enabling auto sign-in, remembering federated accounts, or restoring sessions after expiry) while ensuring these operations happen in secure contexts (HTTPS).
- [Credential Stuffing](https://clerk.com/glossary/credential-stuffing.md): Credential stuffing is a cyberattack where attackers use stolen username-password pairs from data breaches to gain unauthorized access to user accounts by automating login attempts across multiple websites and services.
- [Credential Stuffing Attacks](https://clerk.com/glossary.md#credential-stuffing-attacks): Credential Stuffing Attacks involve using stolen username-password pairs to gain unauthorized access to user accounts by automating login attempts across multiple websites and services.
- [Cross Site Request Forgery (CSRF)](https://clerk.com/glossary.md#cross-site-request-forgery-csrf): Cross Site Request Forgery (CSRF) is an attack that tricks a user into performing actions on a web application without their consent, often by exploiting the user’s authenticated session.
- [Cross-Platform Development](https://clerk.com/glossary.md#cross-platform-development): Cross-platform development is the practice of building applications that run on multiple operating systems or platforms from a single codebase, using frameworks and tools that abstract platform-specific differences.
- [Cross-Site Scripting (XSS)](https://clerk.com/glossary.md#cross-site-scripting-xss): Cross-Site Scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially leading to data theft, session hijacking, and other exploits.
- [Cryptographic Nonce](https://clerk.com/glossary.md#cryptographic-nonce): A cryptographic nonce is a unique, unpredictable value generated for one-time use in a cryptographic operation or protocol to bind a request and its response. In OpenID Connect, a nonce is sent in the authentication request and echoed in the ID Token to prevent replay attacks. In OAuth flows, the `state` parameter plays a related role by binding the redirect request to its response (protecting against CSRF). A nonce must never be reused and is typically random, time-variant, or both, so that stale or duplicated values are detected and rejected.
- [CSS Framework](https://clerk.com/glossary.md#css-framework): A CSS framework is a pre-built collection of CSS styles, utilities, and components that provides a consistent design system for building user interfaces, reducing the need to write custom styling from scratch.
- [Custom Onboarding](https://clerk.com/glossary.md#custom-onboarding): Custom Onboarding refers to the process of creating a tailored user onboarding experience, guiding new users through initial setup and familiarization with an application.
- [Custom Permissions](https://clerk.com/glossary.md#custom-permissions): Custom Permissions allow developers to define specific access rights for different users within an application, providing fine-grained control over what each user can do based on their role.
- [Custom Roles](https://clerk.com/glossary.md#custom-roles): Custom Roles enable developers to create specific roles with tailored permissions for different user types, ensuring that users have appropriate access levels within an application.
- [Customizable Session Tokens](https://clerk.com/glossary.md#customizable-session-tokens): Customizable Session Tokens are session tokens that can be configured to include specific data or metadata, enhancing the flexibility and security of session management.
- [Data Fetching](https://clerk.com/glossary.md#data-fetching): Data fetching is the process of retrieving data from servers, databases, or APIs for use in application rendering, often handled through dedicated loader functions or server components in modern web frameworks.
- [Data Privacy](https://clerk.com/glossary.md#data-privacy): Data privacy is the practice of protecting personal information from unauthorized access and ensuring that data collection, storage, and processing comply with applicable regulations and user expectations.
- [Data Protection](https://clerk.com/glossary.md#data-protection): Data protection refers to the technical and organizational measures used to safeguard data from unauthorized access, corruption, or loss, including encryption, access controls, and secure storage practices.
- [Data Residency](https://clerk.com/glossary.md#data-residency): Data Residency refers to the geographical or physical location where an organization's data is stored, processed, or maintained (for example, in which country, region, or data center). When cloud or hosted services are used, it determines which jurisdiction(s) control or regulate that data. This matters for legal, regulatory, and contractual compliance because different regions have laws about how data may be handled, transferred, or accessed.
- [Data Retention](https://clerk.com/glossary.md#data-retention): Data retention defines how long an organization can store customer or user data, including authentication records such as logs, sessions, tokens, and audit trails. Retention periods are determined by legal, regulatory, and operational requirements, and are essential for supporting investigations, ensuring compliance, and maintaining privacy standards. For instance, HIPAA mandates a six-year minimum retention for audit logs related to protected health information, while PCI DSS requires audit trail logs to be retained for at least one year.
- [Data Retention](https://clerk.com/glossary.md#data-retention-auth-data): Data Retention defines how long authentication records such as logs, sessions, tokens, and audit trails are kept before deletion or archival. Retention periods support investigations, meet legal and compliance requirements, and respect privacy constraints.
- [Data Router](https://clerk.com/glossary.md#data-router): A Data Router is a routing system that manages data fetching and rendering based on URL paths, ensuring that the necessary data is available for each route.
- [Database](https://clerk.com/glossary.md#database): A database is a structured system for storing, organizing, and retrieving data, serving as the foundation for application state, user records, and authentication data in web and mobile applications.
- [DDoS Mitigation](https://clerk.com/glossary.md#ddos-mitigation-auth-endpoints): DDoS (Distributed Denial-of-Service) mitigation consists of strategies and defenses designed to protect services against distributed denial-of-service attacks, where many compromised systems send massive amounts of traffic to overwhelm a target. For authentication systems, these attacks can overwhelm login, signup, and token services, preventing legitimate users from signing in or creating accounts. Effective mitigation relies on detecting unusual traffic, filtering out malicious requests, applying rate limits, challenging suspicious activity (e.g., CAPTCHAs or bot checks), and routing traffic through specialized filtering services to distinguish between real users and malicious requests.
- [Delegated Admin](https://clerk.com/glossary.md#delegated-admin): Delegated Admin refers to a role-based (RBAC) administrative model where certain management privileges are granted to users or groups without giving them full organizational or system-wide administrative access. This allows tasks such as managing users, groups, or resources within specific scopes like a department, team, or application, while maintaining overall security and limiting exposure. Delegated administration helps organizations enforce separation of duties by empowering trusted individuals to perform targeted administrative tasks without granting complete control.
- [Design System](https://clerk.com/glossary.md#design-system): A design system is a collection of reusable components, patterns, and guidelines that ensure visual and functional consistency across an application or suite of products.
- [Deterministic Encryption](https://clerk.com/glossary.md#deterministic-encryption): Deterministic encryption is a cryptographic method where the same plaintext input always produces the same ciphertext output when encrypted with a given key. This allows for operations such as equality checks, deduplication, or indexing on encrypted data without decryption. While convenient for search and comparison, deterministic encryption can leak patterns, such as repeated values, making it less secure than probabilistic encryption for sensitive data. It's often used when structured queries on encrypted fields are required while still providing a level of confidentiality.
- [Developer Velocity](https://clerk.com/glossary.md#developer-velocity): Developer Velocity refers to the speed and efficiency with which developers can deliver software, often enhanced by tools, processes, and practices that streamline development workflows.
- [Device Binding](https://clerk.com/glossary.md#device-binding): Device Binding is a security technique that associates a user's authentication credentials or cryptographic keys with a specific device. By linking access tokens, certificates, or cryptographic secrets to a device, systems can ensure that only requests originating from the trusted device are accepted. This reduces the risk of credential theft or replay attacks, as stolen credentials alone are insufficient to gain access without the bound device. Device binding is commonly used in multi-factor authentication, mobile banking, and enterprise security to strengthen trust in user-device relationships.
- [Device Fingerprint](https://clerk.com/glossary.md#device-fingerprint): A device fingerprint is a unique identifier created from a combination of a device's attributes, such as browser type, operating system, screen resolution, installed fonts, and hardware characteristics, that can be used to recognize or track a device across sessions. Unlike traditional identifiers like cookies, device fingerprints don't rely on client-side storage and are harder to tamper with. They're commonly used for fraud detection, risk-based authentication, and security monitoring, helping systems detect unusual login attempts or account takeover attempts by identifying unfamiliar or suspicious devices.
- [Directory Sync](https://clerk.com/glossary.md#directory-sync): Directory Sync is the process of synchronizing user identities, groups, and related attributes between an organization's identity provider (such as Active Directory, OneLogin, or LDAP) and another system or application. This ensures that user accounts, roles, and permissions remain consistent across platforms, reducing administrative overhead and minimizing the risk of stale or incorrect identity or permission data. Directory synchronization can be one-way or bidirectional and is commonly used to automate onboarding, offboarding, and access updates in enterprise environments.
- [Discovery Document (OIDC)](https://clerk.com/glossary.md#discovery-document-oidc): In OpenID Connect (OIDC), the Discovery Document is a JSON file published by the identity provider that describes its configuration, endpoints, and capabilities. It typically includes URLs for authorization, token, userinfo, and JSON Web Key Sets (JWKS), supported scopes, response types, grant types, and signing algorithms. Clients use this document to automatically configure themselves, ensuring they know where and how to make requests without requiring manual setup or hardcoding of endpoints.
- [Disposable Email Detection](https://clerk.com/glossary.md#disposable-email-detection): Disposable Email Detection identifies and blocks the use of temporary email addresses, which are often used for fraudulent activities, ensuring that only legitimate users can sign up and interact with an application.
- [DKIM](https://clerk.com/glossary/dkim.md): DKIM (DomainKeys Identified Mail) is an email authentication method that adds a cryptographic signature to outgoing messages, allowing receiving servers to verify that the email was sent by an authorized server and has not been altered in transit.
- [DMARC](https://clerk.com/glossary/dmarc.md): DMARC (Domain-based Message Authentication, Reporting & Conformance) is an email authentication protocol that ties SPF and DKIM together and tells receiving mail servers what to do when a message fails authentication — nothing, quarantine it, or reject it outright.
- [Dynamic Client Registration](https://clerk.com/glossary.md#dynamic-client-registration): Dynamic Client Registration is an OAuth 2.0 and OpenID Connect feature that allows clients (applications) to register with an authorization server automatically at runtime, rather than requiring manual registration by an administrator. During this process, the client receives credentials such as a `client_id` and, if applicable, a `client_secret`. This enables scalable onboarding of new applications and automated workflows in environments where many clients need to connect to an identity provider without manual intervention.
- [E2E Encryption](https://clerk.com/glossary.md#e2e-encryption): End-to-End Encryption is a security approach where data is encrypted on the sender's device and only decrypted on the recipient's device, ensuring that no intermediate systems (including servers, service providers, or network nodes) can read the data in transit. This protects sensitive information from eavesdropping, interception, or unauthorized access. E2E encryption is commonly used in messaging apps, file storage, and authentication flows to ensure that only intended parties can access the plaintext data, even if the communication channel or server is compromised.
- [Elements](https://clerk.com/glossary.md#elements): Elements refer to the library of unstyled, composable components for building custom UIs, allowing developers to create tailored authentication experiences that fit their application’s design.
- [Email Links](https://clerk.com/glossary.md#email-links): Email Links are a passwordless authentication method where users receive a link via email that, when clicked, automatically logs them into the application.
- [Email OTP](https://clerk.com/glossary.md#email-otp): An Email OTP (One-Time Password) is a single-use, time-limited code sent to a user's email address as part of an authentication or verification process. Users enter the OTP to prove ownership of the email account and complete actions such as sign-in, account recovery, or sensitive transactions. Email OTPs provide a simple, passwordless or multi-factor authentication method, but their security depends on the email account being secure, as interception or compromise of the inbox could allow unauthorized access.
- [Email Spoofing](https://clerk.com/glossary.md#email-spoofing): Email spoofing is a technique where attackers forge the sender address of an email to make it appear as if it comes from a trusted source, often to carry out phishing or fraud. To combat this, organizations use authentication protocols like SPF, DKIM, and DMARC. SPF (Sender Policy Framework) specifies which mail servers are allowed to send emails on behalf of a domain. DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing emails, allowing recipients to verify the message hasn't been altered and is from the claimed sender. DMARC (Domain-based Message Authentication, Reporting & Conformance) builds on SPF and DKIM to provide domain owners with policies for handling unauthenticated emails and reporting on suspicious activity. Together, these mechanisms reduce the risk of spoofed emails reaching users and help protect brand reputation and security.
- [Embedded Login vs Hosted](https://clerk.com/glossary.md#embedded-login-vs-hosted): Embedded login refers to authentication flows that appear directly within your application's UI, for example `app.company.com/login`, allowing users to authenticate without leaving the app. This provides full control over the UI and UX but requires careful handling of credentials and other security tradeoffs. Hosted login, in contrast, redirects users to a provider-managed page, such as `auth.provider.com`, to handle sign-in, registration, or password recovery. The provider manages credentials and token issuance, reducing your app's exposure to sensitive data, though with less control over the user experience.
- [Encrypted Cookies](https://clerk.com/glossary.md#encrypted-cookies): Encrypted cookies are HTTP cookies whose contents are encrypted before being sent to the client, ensuring that sensitive data such as session identifiers, authentication tokens, or user preferences cannot be read or tampered with by unauthorized parties. By encrypting the cookie payload, the server protects against data leakage and manipulation while still allowing the client to store and return the cookie on subsequent requests. Secure management of encryption keys and proper use of cookie attributes like `Secure` and `HttpOnly` are essential to maintain confidentiality and integrity.
- [Encryption at Rest / In Transit](https://clerk.com/glossary.md#encryption-at-rest-in-transit): Encryption at rest refers to the practice of encrypting data while it's stored on disk or in persistent storage, protecting it from unauthorized access if the storage medium is compromised. Encryption in transit secures data as it moves across networks, such as between clients, servers, and APIs, preventing eavesdropping or tampering. Together, these encryption strategies ensure that sensitive information like authentication tokens, personal data, or application secrets remains confidential and intact, both when stored and while being transmitted.
- [Endpoint](https://clerk.com/glossary.md#endpoint): An Endpoint is a specific URL where an API can be accessed by a client application, serving as a communication point between different systems or components.
- [Entitlements](https://clerk.com/glossary.md#entitlements): Entitlements are fine-grained rights assigned to a subject or resource, for example `"invoice.read"` on tenant X, used by authorization engines to determine access. They are often modeled as attributes separate from broader roles, enabling precise control over what actions a user or system can perform.
- [Environment Keys](https://clerk.com/glossary.md#environment-keys): Environment Keys are configuration settings stored in environment variables, used to manage different environments (development, testing, production) in software applications.
- [Environment Variables](https://clerk.com/glossary.md#environment-variables): Environment Variables are dynamic values that can affect the behavior of running processes, commonly used to configure applications without hardcoding sensitive information.
- [Ephemeral Keys](https://clerk.com/glossary.md#ephemeral-keys): Ephemeral Keys are short-lived cryptographic keys created for temporary use in a specific session, handshake, or transaction and then destroyed. They limit blast radius if compromised and enable forward secrecy by ensuring that past encrypted data remains secure even if long-term keys are later compromised. Common use cases include TLS session keys, one-time API tokens, and temporary encryption keys for secure data exchange between clients and servers.
- [Event Audit Trail](https://clerk.com/glossary.md#event-audit-trail): An event audit trail is a chronological record of actions and events within a system, capturing details such as who performed an action, what was done, when it occurred, and from where. In authentication and authorization contexts, audit trails often include logins, logouts, token usage, permission changes, and administrative actions. Maintaining detailed audit trails enable security teams to investigate incidents, verify compliance with regulations, and hold users or systems accountable for their actions.
- [Event Webhooks](https://clerk.com/glossary.md#event-webhooks-security): Event webhooks are signed HTTP callbacks that notify external systems when specific events occur within an application or service. Instead of polling for updates, a system can subscribe to events and receive real-time notifications via HTTP requests to a configured endpoint. Payloads are authenticated with a shared secret or key pair and include timestamps/ids to detect replay.
- [Evidence of Consent](https://clerk.com/glossary.md#evidence-of-consent): Evidence of consent is a record that demonstrates a user has knowingly and voluntarily granted permission for an application or service to access their data or perform specific actions on their behalf. This may include timestamps, the scopes or permissions granted, the interface where consent was given, and the user or device identity. This creates an auditable trail that organizations can reference during privacy reviews, compliance audits, or if users later dispute their consent decisions.
- [Expo](https://clerk.com/glossary.md#expo): Expo is a framework and platform for universal React applications, providing tools and services to build, deploy, and manage native apps for iOS and Android.
- [Fingerprinting](https://clerk.com/glossary.md#fingerprinting): Fingerprinting is a technique used to uniquely identify devices and users based on their browser and device characteristics, enhancing security measures and preventing unauthorized access.
- [Firebase](https://clerk.com/glossary.md#firebase): Firebase is a platform developed by Google for creating mobile and web applications, offering services like real-time databases, authentication, and cloud storage.
- [First Day Free](https://clerk.com/glossary.md#first-day-free): First Day Free means no charges for users who sign up but never return. Users are only counted as active when they come back after 24 hours, ensuring fair and user-friendly billing practices.
- [Framework](https://clerk.com/glossary.md#framework): A Framework is a platform for developing software applications that provides foundational structures and tools, such as React, Next.js, React Router (Framework), and Expo to streamline the development process.
- [Frontend API](https://clerk.com/glossary/frontend-api.md): A Frontend API is an interface that allows client-side applications to interact with backend services, providing secure and straightforward methods for implementing features directly within the application’s frontend.
- [Frontend Development](https://clerk.com/glossary.md#frontend-development): Frontend development is the practice of building the user-facing portion of web and mobile applications, including UI components, routing, state management, and client-server interaction.
- [Full Stack Development](https://clerk.com/glossary.md#full-stack-development): Full stack development encompasses both frontend and backend engineering, involving the design and implementation of complete applications from user interface to server logic and data storage.
- [Gatsby](https://clerk.com/glossary.md#gatsby): Gatsby is a React-based open-source framework for building fast, scalable, and secure static websites and applications with a focus on performance and developer experience.
- [GitHub Repository](https://clerk.com/glossary.md#github-repository): A GitHub Repository is a storage space on GitHub where code, documentation, and other project files are managed and shared, facilitating collaboration and version control among developers.
- [Hardware Keys](https://clerk.com/glossary.md#hardware-keys): Hardware Keys are physical devices used for authentication that generate and store cryptographic keys, providing an additional layer of security. Examples include USB security keys like YubiKey, which are used in two-factor authentication (2FA) and multi-factor authentication (MFA) processes to ensure secure access to systems and data.
- [Hash](https://clerk.com/glossary.md#hash): Hashing is a way of converting data into a unique, fixed-length code that acts like a digital fingerprint. When a piece of information is run through a hashing process, it creates a specific string of characters that uniquely represents the original data. The hash can verify that the original data hasn't been changed, and cannot be 'decoded' to recreate the original information. The same input will always produce the same hash, and different inputs will typically produce different hashes. One piece of data can have multiple types of hashes generated from it depending on the specific purpose, such as checking if a password is correct or ensuring a file hasn't been tampered with.
- [Hash Routing](https://clerk.com/glossary.md#hash-routing): Hash Routing is a routing method that uses the URL hash (fragment identifier) to manage navigation and rendering of components in a single-page application.
- [Health Insurance Portability & Accountability Act (HIPAA)](https://clerk.com/glossary.md#health-insurance-portability-accountability-act-hipaa): The Health Insurance Portability & Accountability Act (HIPAA) is a U.S. law designed to provide privacy standards to protect patients’ medical records and other health information provided to health plans, doctors, hospitals, and other healthcare providers.
- [HttpOnly cookies](https://clerk.com/glossary.md#httponly-cookies): HttpOnly cookies are a type of browser cookie that is inaccessible to JavaScript, providing an additional layer of security by mitigating the risk of client-side script attacks like Cross-Site Scripting (XSS).
- [Identity Management](https://clerk.com/glossary.md#identity-management): Identity management is the framework of policies, processes, and technologies used to manage digital identities and control access to resources, encompassing user provisioning, authentication, and directory services.
- [Identity Provider](https://clerk.com/glossary/identity-provider.md): An identity provider (IdP) authenticates users and shares information about their identity with an application. In SAML single sign-on (SSO), it sends an authentication assertion to the service provider (SP). In OpenID Connect, the equivalent role is called an OpenID Provider.
- [Integration](https://clerk.com/glossary.md#integration): Integration refers to the process of connecting different systems, applications, or services to work together seamlessly, enabling data exchange and functional cooperation.
- [IP Warming](https://clerk.com/glossary.md#ip-warming): IP warming (also called IP address warming) is the practice of gradually increasing the volume of email sent from a new or dormant IP address to build a positive sending reputation with email providers. Sending too much email too quickly from an unfamiliar IP address can trigger spam filters and delivery throttling. A controlled ramp-up allows providers to observe consistent, legitimate sending patterns and establish trust over time.
- [Isolated user-pool](https://clerk.com/glossary.md#isolated-user-pool): An Isolated user-pool is a user management system where each application has its own separate pool of user accounts, ensuring isolation and independence between applications.
- [JSON Web Token](https://clerk.com/glossary.md#json-web-token): A JSON Web Token (JWT) is a compact, URL-safe token used for securely transmitting information between parties as a JSON object, commonly used in authentication and authorization.
- [JWKS](https://clerk.com/glossary.md#jwks): A JWKS (JSON Web Key Set) is a JSON document containing the public cryptographic keys used to verify signed JWTs. Authorization servers publish a JWKS at a well-known URL (e.g., /.well-known/jwks.json) so resource servers can fetch the keys, verify token signatures, and rotate keys without requiring a redeploy. Each key in the set is identified by a key ID (kid) referenced in the JWT header. Clerk publishes a JWKS endpoint for every instance.
- [LDAP](https://clerk.com/glossary.md#ldap): LDAP (Lightweight Directory Access Protocol) is an open, vendor-neutral application protocol for accessing and maintaining directory services over a TCP/IP network. A directory service stores identity data — such as usernames, passwords, email addresses, group memberships, and access privileges — in a hierarchical tree structure, where each entry is identified by a Distinguished Name (DN). LDAP provides the standard language that applications use to query and update this data. For authentication, a client sends a bind request containing user credentials to the LDAP server, which validates them against the directory and grants or denies access. LDAP is not a directory service itself — it is the protocol used to communicate with one. Microsoft Active Directory, for example, is a directory service that uses LDAP as one of its primary access protocols. In enterprise environments, LDAP remains foundational for centralized authentication, directory sync, and integrating on-premises identity infrastructure with modern applications via SSO and SAML.
- [Least Privilege Access](https://clerk.com/glossary.md#least-priveledge-access): Least Privilege Access is a security principle where users, applications, and systems are granted the minimum access necessary to perform their tasks, reducing risk.
- [Libraries](https://clerk.com/glossary.md#libraries): Libraries are reusable collections of pre-written code that provide specific functionality, allowing developers to build applications more efficiently without implementing common features from scratch.
- [Loader Function](https://clerk.com/glossary.md#loader-function): A Loader Function is a function that fetches or prepares data needed for rendering a component or page in a web application.
- [Magic Link](https://clerk.com/glossary.md#magic-link): A magic link is a passwordless authentication method where a user receives a one-time signed URL via email; clicking it signs them in without entering a password. The link contains a short-lived token that the auth server validates on click. Magic links reduce password fatigue, eliminate one credential to phish, and typically improve sign-up completion rates over password-based flows. Clerk supports magic links for sign-in and sign-up.
- [Middleware](https://clerk.com/glossary.md#middleware): Middleware is software that acts as a bridge between an operating system or database and applications, especially on a network, enabling communication and data management.
- [Monthly Active Users (MAUs)](https://clerk.com/glossary.md#monthly-active-users-maus): Monthly Active Users (MAUs) is a metric that counts the number of unique users who interact with an application or service within a given month, indicating user engagement and growth.
- [Monthly Retained Organizations (MROs)](https://clerk.com/glossary.md#monthly-retained-organizations-mros): Monthly Retained Organizations (MROs) is a usage metric that counts organizations with at least 2 members, where at least one of those members is a monthly retained user in a given month. This metric is used alongside Monthly Retained Users (MRUs) to measure usage for applications that leverage multi-tenant or B2B SaaS organization structures.
- [Monthly Retained Users (MRUs)](https://clerk.com/glossary.md#monthly-retained-users-mrus): Monthly Retained Users (MRUs) is a usage metric that counts users who have at least one active session during a given month. Unlike Monthly Active Users (MAUs), which can count any user interaction, MRUs specifically track users who maintain authenticated sessions, providing a more accurate reflection of meaningful application usage.
- [Multi-factor Authentication (MFA)](https://clerk.com/glossary.md#multi-factor-authentication-mfa): Multi-factor Authentication (MFA) is a security process that requires users to provide two or more verification factors to gain access to a resource, enhancing security beyond just a username and password.
- [Multi-Tenancy](https://clerk.com/glossary/multi-tenancy.md): Multi-Tenancy is an architecture in which a single instance of software serves multiple customers (tenants), with each tenant’s data isolated and invisible to others.
- [Multi-tenant](https://clerk.com/glossary.md#multi-tenant): Multi-tenant describes software that serves multiple customers ("tenants") from shared infrastructure, with each tenant's data and configuration logically isolated. The architecture pattern itself is called multi-tenancy. Multi-tenant systems isolate data via separate databases, separate schemas, or row-level filtering — each with different trade-offs between cost, blast radius, and performance. Most modern SaaS apps are multi-tenant. Clerk Organizations make multi-tenancy native to your auth layer.
- [Next.js](https://clerk.com/glossary.md#next-js): Next.js is a React-based framework that enables server-side rendering and static site generation for building fast, scalable web applications.
- [Node Package Manager](https://clerk.com/glossary.md#node-package-manager): Node Package Manager (NPM) is a package manager for JavaScript that allows developers to install, share, and manage dependencies for their projects.
- [OAuth](https://clerk.com/glossary.md#oauth): OAuth is an open standard for access delegation commonly used as a way to grant websites or applications limited access to user information without exposing passwords.
- [OAuth Scopes](https://clerk.com/glossary.md#oauth-scopes): OAuth Scopes define the specific permissions granted to a client application, determining the actions or resources it can access when interacting with a protected API.
- [One-Time Passcodes (Email / SMS)](https://clerk.com/glossary.md#one-time-passcodes-email-sms): One-Time Passcodes (OTP) are temporary codes sent via email or SMS that users enter to verify their identity, commonly used in two-factor authentication processes.
- [Opaque Token](https://clerk.com/glossary.md#opaque-token): An opaque token is a type of access token that is not human-readable and cannot be easily inspected or decoded. It is used to authenticate requests to a protected resource. Opaque tokens are normally verified with a network call to the issuer rather than a digital signature verification, and can be revoked immediately -- both properties that are different from JWTs.
- [OpenID Connect (OIDC)](https://clerk.com/glossary/openid-connect.md): OpenID Connect is an identity layer on top of the OAuth 2.0 protocol, allowing clients to verify the identity of end-users based on authentication performed by an authorization server.
- [Organizations](https://clerk.com/glossary.md#organizations): Organizations in user management refer to groups or entities that manage multiple users, roles, and permissions within a larger structure, often used in enterprise applications.
- [OWASP Application Security Verification Standard (ASVS)](https://clerk.com/glossary.md#owasp-application-security-verification-standard): The OWASP Application Security Verification Standard (ASVS) is a framework for testing the security of web applications and ensuring they meet specific security requirements. It provides a basis for designing, building, and testing secure applications by defining levels of security controls. ASVS is widely used by developers and security professionals to standardize security requirements and assessments.
- [OWASP Testing Guide / Security Verification](https://clerk.com/glossary.md#owasp-testing-guide-security-verification): The OWASP Testing Guide and Application Security Verification Standard (ASVS) provide comprehensive frameworks for testing and verifying the security of web applications, covering authentication, session management, access control, and input validation.
- [Pages Router](https://clerk.com/glossary.md#pages-router): A Pages Router is a routing mechanism that maps URLs to specific pages or components in a web application, often used in frameworks like Next.js.
- [Passkeys](https://clerk.com/glossary.md#passkeys): Passkeys are cryptographic keys used for secure authentication, replacing traditional passwords with more secure alternatives like biometrics or hardware tokens.
- [Passwordless Login](https://clerk.com/glossary.md#passwordless-login): Passwordless login is an authentication approach that eliminates traditional passwords in favor of more secure and user-friendly methods such as passkeys, email links, biometric verification, or one-time passcodes.
- [Path Routing](https://clerk.com/glossary.md#path-routing): Path Routing is a routing method that uses the URL path to determine which component or page to render in a web application.
- [Pen Test](https://clerk.com/glossary.md#pen-test): A Pen Test (Penetration Test) is a simulated cyber attack against a system to check for exploitable vulnerabilities, helping to identify and fix security weaknesses.
- [Personal Account](https://clerk.com/glossary.md#personal-account): A personal account is a user’s unique, individual space within the application, independent of any organization.
- [Primitives](https://clerk.com/glossary.md#primitives): Primitives are the basic building blocks or fundamental elements used in programming and design, such as data types in a programming language or basic UI components in a design system.
- [PTR Record](https://clerk.com/glossary.md#ptr-record): A PTR (pointer) record is a DNS record that maps an IP address to a hostname, enabling reverse DNS lookups. Email providers use PTR records to verify that a sending server's IP address resolves to a legitimate hostname. When the hostname also resolves forward to the same IP — a check called forward-confirmed reverse DNS (FCrDNS) — it proves that the IP owner and hostname owner are the same entity. Gmail requires valid FCrDNS for all email senders, and other major providers use it as a trust signal.
- [Public Metadata](https://clerk.com/glossary.md#public-metadata): Public Metadata refers to metadata that is publicly accessible and can be used to store additional information about users or resources in a transparent manner.
- [Public-Key Cryptography](https://clerk.com/glossary.md#public-key-cryptography): Public-key cryptography (also called asymmetric cryptography) is an encryption system that uses a pair of mathematically related keys — a public key that can be shared openly and a private key that must be kept secret. Data encrypted with one key can only be decrypted with the other. This property enables secure communication, digital signatures, and identity verification without requiring both parties to share a secret in advance. Public-key cryptography underpins TLS, DKIM, SSH, and most modern authentication protocols.
- [Publishable Key](https://clerk.com/glossary.md#publishable-key): A Publishable Key is a public API key used to identify a client application in API requests, typically safe to expose in client-side code.
- [Rails](https://clerk.com/glossary.md#rails): Rails (Ruby on Rails) is a server-side web application framework written in Ruby, designed to make web development faster and easier by providing default structures for databases, web services, and pages.
- [Rate Limiting](https://clerk.com/glossary.md#rate-limiting): Rate Limiting is a technique used to control the amount of incoming or outgoing traffic to or from a network, API, or web service, preventing abuse and ensuring fair usage.
- [React](https://clerk.com/glossary.md#react): React is a popular JavaScript library for building user interfaces, particularly single-page applications, using a component-based architecture.
- [React Components](https://clerk.com/glossary.md#react-components): React components are reusable, self-contained building blocks for user interfaces in React applications, encapsulating markup, styling, and behavior into composable units that can be rendered on the client or server.
- [React Router (Framework)](https://clerk.com/glossary.md#react-router-framework): React Router (formerly Remix) is a full-stack web framework that enables developers to build fast, scalable, and dynamic web applications with a focus on user experience and performance.
- [React Router (Library)](https://clerk.com/glossary.md#react-router-library): React Router is a client-side routing library for React applications that enables navigation between views, URL management, and data loading patterns without full page reloads.
- [React Server Components](https://clerk.com/glossary.md#react-server-components): React Server Components are a feature in React that allows developers to build components that run on the server, providing better performance and improved user experience.
- [Recovery Codes](https://clerk.com/glossary.md#recovery-codes): Recovery Codes are backup codes provided during the setup of two-factor authentication, allowing users to regain access to their accounts if they lose their primary authentication method.
- [Refresh Token](https://clerk.com/glossary.md#refresh-token): A refresh token is a long-lived credential issued alongside an access token during an OAuth 2.0 or OpenID Connect flow that allows a client to obtain a new access token without requiring the user to re-authenticate. Access tokens are intentionally short-lived (minutes to hours) to limit exposure if compromised; when one expires, the client sends the refresh token to the authorization server's token endpoint to receive a fresh access token. Refresh tokens are typically requested by including the offline_access scope in the initial authorization request. Because a refresh token effectively grants persistent access, it must be stored securely — in server-side storage or secure device storage, never in browser localStorage. To reduce the risk of token theft, many implementations use refresh token rotation, which issues a new refresh token with each exchange and invalidates the previous one. If a previously used refresh token is presented again, the authorization server can detect the reuse and revoke the entire token family.
- [Role Based Access Control (RBAC)](https://clerk.com/glossary.md#role-based-access-control-rbac): Role Based Access Control (RBAC) is a security model that restricts system access based on roles assigned to users, ensuring that users have appropriate permissions for their roles.
- [Roles](https://clerk.com/glossary.md#roles): Roles define a set of permissions and access levels assigned to users within an application, determining what actions they can perform and what resources they can access.
- [Root Loader](https://clerk.com/glossary.md#root-loader): A Root Loader is a function or component that loads initial data or performs setup tasks when the root of an application or route is accessed.
- [rootAuthLoader](https://clerk.com/glossary.md#rootauthloader): rootAuthLoader is a specific loader function responsible for handling authentication logic at the root level of an application, ensuring that user authentication state is properly managed.
- [Route-Specific Authentication](https://clerk.com/glossary.md#route-specific-authentication): Route-Specific Authentication is the practice of applying authentication requirements to specific routes or endpoints within an application, ensuring secure access to sensitive resources.
- [Secret Key](https://clerk.com/glossary.md#secret-key): A Secret Key is a cryptographic key used to secure data, often involved in encryption, decryption, and authentication processes, and should be kept confidential.
- [Security Assertion Markup Language (SAML)](https://clerk.com/glossary.md#security-assertion-markup-language-saml): Security Assertion Markup Language (SAML) is an open standard for exchanging authentication and authorization data between parties, particularly between an identity provider and a service provider.
- [Security Best Practices](https://clerk.com/glossary.md#security-best-practices): Security Best Practices are the established guidelines, patterns, and strategies that organizations follow to protect their applications, data, and users from threats and vulnerabilities. In authentication systems, this includes implementing defense-in-depth with multiple verification layers, validating inputs at every data access point, enforcing rate limiting on sensitive endpoints, and keeping dependencies patched against known vulnerabilities. Following security best practices reduces the risk of common attacks like credential stuffing, cross-site request forgery, and session hijacking while ensuring compliance with industry standards.
- [Security Monitoring](https://clerk.com/glossary.md#security-monitoring): Security monitoring is the continuous observation and analysis of system activity to detect, investigate, and respond to security threats, unauthorized access attempts, and suspicious behavior in real time.
- [Server-Side Rendering (SSR)](https://clerk.com/glossary.md#server-side-rendering-ssr): Server-side rendering (SSR) is a technique where web pages are generated on the server for each request, delivering fully rendered HTML to the browser for improved performance, SEO, and initial load times.
- [Service Provider](https://clerk.com/glossary/service-provider.md): A service provider (SP) is an application or service that relies on an identity provider (IdP) to authenticate users. In SAML single sign-on, it validates the IdP's assertion before granting access to the user.
- [Session](https://clerk.com/glossary.md#session): A session represents an instance in which a user has signed in and is authenticated. Normally, when a user signs in successfully, a session is created and typically stored in a database, along with the user's ID, a status (active, revoked, expired, etc) and an expiration time, at miniumum. The session must be active and not expired in order for the user to be seen as authenticated. One user can, and typically does, have multiple sessions. Each time the user signs in, whether on the same or a different device, creates a new session.
- [Session Fixation](https://clerk.com/glossary.md#session-fixation): Session Fixation is a security vulnerability where an attacker tricks a user into using a known session ID, allowing the attacker to hijack the session once the user logs in.
- [Session Leak Protection](https://clerk.com/glossary.md#session-leak-protection): Session Leak Protection involves measures to prevent the unintended exposure of session identifiers, which could be exploited by attackers to hijack user sessions.
- [Session Lifecycle](https://clerk.com/glossary.md#session-lifecycle): Session Lifecycle refers to the stages a user session goes through from creation, maintenance, and termination, including management of session state and expiration.
- [Session Management](https://clerk.com/glossary.md#session-management): Session Management is the process of handling user sessions in a web application, ensuring secure creation, maintenance, and termination of sessions to prevent unauthorized access.
- [Session Revocation](https://clerk.com/glossary.md#session-revocation): Session Revocation is the process of invalidating a user session, typically used to force logout a user or end a session due to security concerns.
- [Shared user-pool](https://clerk.com/glossary.md#shared-user-pool): A Shared user-pool is a user management system where multiple applications share the same pool of user accounts, allowing for centralized authentication and user management.
- [Single Sign-On (SSO)](https://clerk.com/glossary/single-sign-on-sso.md): Single Sign-On (SSO) is an authentication process that allows a user to access multiple applications with one set of login credentials, simplifying user management and enhancing security.
- [SMS passcodes](https://clerk.com/glossary/sms-passcodes.md): SMS Passcodes are one-time codes sent via SMS to a user’s mobile phone, used for verifying identity and enhancing security in two-factor authentication processes.
- [SOC 2](https://clerk.com/glossary.md#soc-2): SOC 2 (Service Organization Control 2) is a set of standards for managing customer data based on five "trust service principles"—security, availability, processing integrity, confidentiality, and privacy.
- [Social Login](https://clerk.com/glossary.md#social-login): Social login — also called social sign-in, social sign-on, or social authentication — is a form of passwordless authentication that lets users sign in to an application using an existing account from a provider like Google, Apple, Facebook, GitHub, or LinkedIn. Rather than creating a new username and password, the user clicks a "Sign in with…" button, authorizes a permissions request, and is authenticated via OAuth or OpenID Connect (OIDC). This reduces sign-up friction, lowers password fatigue, and can improve conversion rates, while the provider handles credential storage and verification. Social login is often combined with account linking to let users connect multiple social identities to a single application account.
- [Software Development Kit (SDK)](https://clerk.com/glossary.md#software-development-kit-sdk): A Software Development Kit (SDK) is a collection of tools, libraries, and documentation that developers use to create applications for specific platforms or frameworks.
- [Source Code](https://clerk.com/glossary.md#source-code): Source Code is the human-readable set of instructions that define what a software program does, written in a programming language and maintained in a version control system.
- [Source Code Management](https://clerk.com/glossary.md#source-code-management): Source code management (SCM) encompasses the tools and practices used to track, version, and collaborate on code changes across development teams, enabling parallel development and change history.
- [SPF](https://clerk.com/glossary/spf.md): SPF (Sender Policy Framework) is a DNS-based email authentication protocol that specifies which mail servers are authorized to send email on behalf of a domain, helping receivers detect forged sender addresses.
- [SSO Providers](https://clerk.com/glossary.md#sso-providers): An SSO provider is an identity provider (IdP) that offers single sign-on as a service. They fall into three groups: enterprise IdPs (Okta, Microsoft Entra ID, Google Workspace, OneLogin, Ping Identity) used for workforce SSO; consumer IdPs (Google, Apple, Facebook) used for social sign-in; and developer auth platforms that abstract IdP integration for app builders. Most enterprise IdPs speak SAML or OIDC.
- [Static Site Generation (SSG)](https://clerk.com/glossary.md#static-site-generation-ssg): Static site generation (SSG) is a build-time rendering strategy where HTML pages are pre-generated and served as static files, offering fast load times, improved security, and simplified hosting.
- [Supabase](https://clerk.com/glossary.md#supabase): Supabase is an open-source backend-as-a-service that provides developers with a real-time database, authentication, and storage solutions, simplifying the creation of modern web applications.
- [Tailwind CSS](https://clerk.com/glossary/tailwind-css.md): Tailwind CSS is a utility-first CSS framework that provides low-level utility classes to build custom designs directly in the markup, offering flexibility and efficiency in styling web applications.
- [Testing Tokens](https://clerk.com/glossary.md#testing-tokens): Testing Tokens are tokens used in the development and testing phases to simulate authentication and authorization processes without using real user credentials.
- [TLS](https://clerk.com/glossary.md#tls): TLS (Transport Layer Security) is a cryptographic protocol that encrypts data transmitted between two systems over a network, ensuring privacy and data integrity. It is the standard mechanism for securing web traffic (HTTPS) and email delivery, preventing eavesdropping, tampering, and message forgery during transit. TLS replaced the older SSL (Secure Sockets Layer) protocol and is now required by major email providers like Gmail for all inbound email connections.
- [TLS Handshake](https://clerk.com/glossary.md#tls-handshake): The TLS handshake is the negotiation two parties (client and server) perform at the start of a connection to establish encrypted, authenticated communication. The handshake exchanges supported cipher suites, validates the server's certificate, agrees on session keys, and confirms both sides can encrypt and decrypt subsequent traffic. TLS 1.3 reduced this to a single round trip; TLS 1.2 required two. Failures usually mean version mismatch, expired certificates, or unsupported cipher suites.
- [Token Expiration](https://clerk.com/glossary.md#token-expiration): Token expiration is the mechanism by which authentication and session tokens become invalid after a defined time period, balancing security against user convenience by requiring periodic re-authentication or token refresh.
- [User Enumeration](https://clerk.com/glossary.md#user-enumeration): User enumeration is a technique to determine whether a user account exists on an application, by detecting when failed authentication attempts still return information about the existence or non-existence of user accounts.
- [User Interface Components](https://clerk.com/glossary.md#user-interface-components): User Interface Components are reusable building blocks used to create the visual elements of a web application, such as buttons, forms, and navigation bars.
- [User Management](https://clerk.com/glossary.md#user-management): User Management involves the processes and tools for managing user accounts, roles, permissions, and authentication within an application, ensuring secure and efficient access control.
- [User Profile](https://clerk.com/glossary.md#user-profile): A User Profile is a collection of personal data and preferences associated with a user account, providing a personalized experience within an application.
- [User Provisioning](https://clerk.com/glossary.md#user-provisioning): User provisioning is the process of creating, updating, and removing user accounts in an application — typically driven by an external identity provider in B2B contexts. Three common patterns: just-in-time (JIT) provisioning creates the account on first SSO login; automated provisioning syncs users via SCIM from an IdP like Okta or Microsoft Entra ID; and deprovisioning removes access when an employee leaves. Clerk supports JIT and SCIM provisioning for Enterprise customers.
- [User Verification](https://clerk.com/glossary.md#user-verification): User verification is the process of confirming a user identity through one or more authentication factors, such as passwords, one-time passcodes, biometrics, or challenge-response mechanisms.
- [useSession](https://clerk.com/glossary.md#usesession): useSession is a React hook used in web development to manage user session state, providing authentication status and session details, and enabling sign-in and sign-out actions. It helps conditionally render content based on user login status.
- [Virtual Routing](https://clerk.com/glossary.md#virtual-routing): Virtual Routing is a routing technique that manages navigation and rendering of views in a web application without changing the URL, often used in client-side routing libraries.
- [Vue.js](https://clerk.com/glossary.md#vue-js): Vue.js is a progressive JavaScript framework for building user interfaces, offering a flexible and approachable architecture for creating single-page applications and interactive web experiences.
- [Web Development](https://clerk.com/glossary.md#web-development): Web development encompasses the design, building, and maintenance of websites and web applications, spanning frontend interfaces, backend services, databases, and the infrastructure that connects them.
- [WebAuthn](https://clerk.com/glossary.md#webauthn): WebAuthn (Web Authentication) is a W3C browser standard that enables passwordless, phishing-resistant authentication using public-key cryptography. Instead of transmitting a shared secret like a password, a user's device generates a unique key pair — the private key stays on the device (often protected by biometric authentication or a hardware key), while the public key is registered with the server. During sign-in, the server issues a challenge-response: a fresh, unpredictable nonce that the authenticator signs with the private key, binding the signature to the origin to prevent replay and phishing attacks. This is the protocol that powers passkeys, letting users authenticate with a fingerprint, face scan, or USB security key instead of remembering a password. WebAuthn credentials can be managed programmatically through the browser's Credential Management API and are commonly used as a factor in multi-factor authentication flows.
- [Webhook](https://clerk.com/glossary.md#webhook): A Webhook is an HTTP callback that allows one system to send real-time data to another system as soon as an event occurs, commonly used for integrating different services.
- [Zero Trust Architecture](https://clerk.com/glossary.md#zero-trust-architecture): Zero Trust Architecture is a security model that requires strict identity verification for every person and device attempting to access resources, regardless of their location relative to the network perimeter, operating on the principle of never trust, always verify.