Agent skill · security · jeremylongshore
clerk-security-basics
Implement security best practices with Clerk authentication.
Why this skill is useful
Provides specific implementation details for securing Clerk authentication that the AI wouldn't reliably generate on its own.
What it needs
Requires clerk installed locally. About 4k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Clerk Security Basics Overview Implement security best practices for Clerk authentication: environment variable protection, middleware hardening, API route defense, webhook verification, and session security. Prerequisites Clerk SDK installed and configured Understanding of OWASP authentication best practices Production deployment planned or active Instructions Step 1: Secure Environment Variables Validate at startup that secret keys are not leaked: Step 2: Hardened Middleware Configuration Step 3: Secure API Routes Step 4: Secure Webhook Verification Step 5: Session Security Best Practices Configure session settings in Clerk Dashboard: Session lifetime: 7 days (default) — reduce for sensitive apps Inactivity timeout: Enable for compliance requirements Multi-session mode: Disable unless explicitly needed Output Environment variables secured with leak prevention Middleware with security headers (CSP, X-Frame-Options, etc.) API routes with auth + authz + input validation Webhook endpoint with Svix signature verification Session freshness checks for sensitive operations Error Handling Error Cause Solution ------- ------- ---------- Secret key exposed client-side Imported in client component Move to server-only module, add assertServerOnly() CSP blocks Clerk UI Missing Clerk domain in CSP Add .clerk.accounts.dev to frame-src Webhook verification fails Clock skew on server Ensure server time is NTP-synced Session too old error User idle too long Prompt re-authentication for sensitive actions Examples Rate Limiting Sensitive Endpoints Resources Clerk Security Overview OWASP Authentication Cheatsheet Webhook Verification Next Steps Proceed to clerk-prod-checklist for production readiness review.
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/clerk-security-basics