clerk-nextjs-patterns

Use clerkMiddleware with createRouteMatcher from @clerk/nextjs/server to define public or protected route patterns, then call auth.protect() for routes requiring authentication. Choose public-first for marketing sites or protected-first for internal tools and dashboards.

Call await auth() from @clerk/nextjs/server inside your async Server Component and check isAuthenticated or userId. The await is required—calling auth() without it returns undefined values. Client components use the useAuth() hook instead.

Return 401 when the user is not authenticated (no valid session) and 403 when the user is authenticated but lacks the required permission or role. Check isAuthenticated first, then use has() to verify roles or permissions for the 403 case.

The cache key is missing the userId or orgId, so unstable_cache serves shared data across users. Include the user identifier in both the cache key array and the revalidation tag, then call revalidateTag after mutations.

Yes, use verifyToken from @clerk/backend with CLERK_JWT_KEY, or the jsonwebtoken library with CLERK_PEM_PUBLIC_KEY using RS256. Always validate the exp and nbf claims and extract the token from the Authorization Bearer header or __session cookie.

Call getToken with a JWT template name from auth() server-side or useAuth() client-side, then send it as an Authorization Bearer header. Always null-check the returned token since getToken returns null for unauthenticated users.