clerk-tanstack-patterns

Create a createServerFn that calls auth() from @clerk/tanstack-react-start/server, throw redirect({ to: '/sign-in' }) when isAuthenticated is false, and call that function in the route's beforeLoad. The redirect must be thrown, not returned.

Return the userId from beforeLoad and access it in the loader via the context parameter. The loader can then use context.userId to fetch user-scoped data, and the component reads results with Route.useLoaderData().

The clerkMiddleware is missing from your Vinxi server setup. Add clerkMiddleware() to the requestMiddleware array in src/start.ts so the auth context is populated for all server functions.

Import auth from @clerk/tanstack-react-start/server for server-side code. Client hooks like useAuth and useUser come from the package root; mixing these import paths causes runtime errors.

Yes, create a layout route such as _authenticated.tsx with a beforeLoad auth check and an Outlet component. All child routes under that layout inherit the guard without repeating the check.

Read orgId from auth() in a server function, and in the loader return an empty state with a requiresOrg flag when orgId is null. The component can then render an OrganizationSwitcher or a prompt to select an organization.