clerk-webhooks

Create a POST route at app/api/webhooks/route.ts that calls verifyWebhook from @clerk/nextjs/webhooks, which reads CLERK_WEBHOOK_SIGNING_SECRET automatically. Handle events like user.created by checking evt.type, and exclude the route from Clerk middleware protection.

Listen for user.created, user.updated, and user.deleted events in a verified webhook handler. Extract id, email_addresses, first_name, and last_name from evt.data, then map them to your database columns such as clerkId, email, and name using Prisma or another client.

A 401 means the webhook route is protected by Clerk middleware. Add the webhook path to a public route matcher using createRouteMatcher(['/api/webhooks(.*)']) in clerkMiddleware so unauthenticated Svix requests can reach the endpoint.

Verification fails because express.json() parses the body before signature checking. Use express.raw({ type: 'application/json' }) on the webhook route so verifyWebhook from @clerk/express/webhooks receives the raw body bytes required for signature validation.

No, every webhook handler must verify the signature, even for notification-only use cases like welcome emails or Slack alerts. Skipping verification exposes the endpoint to spoofed events from anyone who knows the URL.

Use webhooks for asynchronous, eventually consistent tasks like database sync and notifications. For synchronous flows where you need data the user just created, read the session token or call the Backend API directly instead of waiting for webhook delivery.