Agent skill · software engineering · jeremylongshore
clerk-core-workflow-b
Implement session management and middleware with Clerk.
Why this skill is useful
Adds specific middleware configuration patterns and session management techniques for Clerk that the AI wouldn't reliably generate on its own.
What it needs
Requires @clerk/nextjs installed locally. Requires clerk account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Clerk Core Workflow B: Session & Middleware Overview Implement session management and route protection with Clerk middleware. Covers clerkMiddleware() configuration, auth() patterns, custom session claims, JWT templates for external services, organization-scoped sessions, and session token v2. Use when managing user sessions, configuring route protection, or implementing token refresh and custom JWT templates. Prerequisites @clerk/nextjs installed with ClerkProvider wrapping the app Next.js 14+ with App Router (or adapt patterns for your stack) Working publishable + secret Clerk keys in env Instructions 1. Confirm ClerkProvider and env keys are live (see clerk-install-auth / clerk-hello-world). 2. Configure clerkMiddleware() matcher / public routes for the routes you want open. 3. Use auth() / currentUser() on protected pages and API routes; fail closed when unauthenticated. 4. For custom claims or external JWT consumers, configure session token templates carefully (size limits). 5. For org-scoped apps, bind authorization to org id + role claims, not only user id. 6. Verify: signed-out user cannot hit protected routes; signed-in user can; org role gates hold. Deep patterns, JWT templates, and edge cases: session-middleware-deep-dive.md. Output Session/middleware configuration enforcing the requested protection rules Documented JWT/session claim changes when customized Verification steps for protected vs public routes Examples Protect all routes except marketing Custom session claim for plan tier Error Handling Condition Response --- --- Route is accidentally public Fail the verification gate and narrow the matcher before release. Session claim is absent or stale Treat the request as unauthorized for the dependent feature and refresh through the supported path. JWT exceeds consumer limits Remove nonessential claims; retrieve server-side attributes through an authorized backend. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/clerk-core-workflow-b--c85128