@clerk/react

Minor Changes

• Support passkeys as a second factor during sign-in and session reverification.

  When a user has a passkey, the prebuilt <SignIn/> and <UserVerification/>
  components preselect it as the second factor, as they already do for the first
  factor. Other methods stay available under "Use another method".

  To use it, your instance must allow passkeys to satisfy the second factor. This
  is on by default for instances created after 2026-07-08, and can be turned on
  in the Dashboard for older ones. Web apps also need to opt in to the passkey
  second factor update in the Dashboard.

  If you build a custom flow, supportedSecondFactors can now include passkey.
  Call signIn.authenticateWithPasskey() to complete it.

  Passkeys are no longer preselected, for either factor, where the SDK reports
  that WebAuthn is unavailable (for example, Electron apps without passkey
  support enabled).

Patch Changes

• Fix <HandleSSOCallback /> dropping the error when a Clerk Protect challenge fails on the SSO callback. The error is now available on errors from useSignIn() or useSignUp(), and a failed sign-up challenge calls navigateToSignUp instead of navigateToSignIn.

Patch Changes

• Custom flows built with useSignIn() and useSignUp() now handle Clerk Protect challenges for you. When a sign-in or sign-up method gets a challenge, Clerk shows it in a modal and the method returns once the user passes it. For SSO, the challenge appears when the user comes back to <HandleSSOCallback />. Classic resource methods such as clerk.client.signIn.create(), and apps without Clerk's UI loaded, still return with protectCheck set, as before.

Patch Changes

• Capture authentication timezones so Clerk emails can display timestamps in a stored user timezone.

Minor Changes

• Rename the SSO fallback sign-in flow to SSO bypass, matching the name the feature ships under. The sign-in resource's ssoFallbackFirstFactors is now ssoBypassFirstFactors and reads the sso_bypass_first_factors field from the API, the signIn.ssoFallback localization keys are now signIn.ssoBypass, and the ssoFallback card action element id is now ssoBypass. The flow has not been enabled on any instance, so no application is affected by the old names going away.

Patch Changes

• Note in the publishableKey JSDoc that @clerk/electron/react requires it.

Minor Changes

• Introduce self-serve Directory Sync (SCIM) capabilities and related functionality.

Patch Changes

• Update docs deep links in JSDoc comments to match clerk.com's new heading anchors (#get-token is now #gettoken, #o-auth-strategy is now #oauthstrategy, and so on).

Minor Changes

• Add an authenticated OAuth device verification component and workflow hook for approving or denying OAuth Device Authorization Grant requests.

Patch Changes

• Fix an issue where a verification that was still progressing normally could be cancelled and reported to the user as having timed out.

Patch Changes

• Fixes an issue where OAuth account transfers that needed additional verification were returned to the beginning of sign-in.

Minor Changes

• Add <InviteMembersButton />, a control component that opens the organization invite-members form in a modal when clicked, working like <SignInButton mode="modal">.

  Wrap your own button (or omit children for a default one). The button requires an active organization and should be rendered for members who can manage memberships (org:sys_memberships:manage). Opening it without an active organization or that permission is a no-op in production, and throws a descriptive error in development.

  import { InviteMembersButton } from '@clerk/nextjs';
  
  <InviteMembersButton>
    <button>Invite members</button>
  </InviteMembersButton>;

  This also adds Clerk.openInviteMembers() and Clerk.closeInviteMembers() for opening and closing the modal programmatically.

Patch Changes

• Fix a false-positive "multiple <ClerkProvider>" crash in apps that run more than one React root in a single JavaScript runtime, most commonly React Native Android apps during activity recreation. <ClerkProvider> now throws this error only when it is genuinely nested inside another <ClerkProvider>.

Patch Changes

• Allow ClerkProvider to omit publishableKey when it is supplied through VITE_CLERK_PUBLISHABLE_KEY or CLERK_PUBLISHABLE_KEY.