What's new at Clerk: August–September 2026

Clerk's changelog was busy in August and September 2026. There were 13 entries in nine weeks. They fall into three groups: OAuth and agent support, enterprise SSO, and tools for finding out why a user could not sign in.

Below is each change in date order, taken from Clerk's changelog. The agent and OAuth work gets its own article, and Clerk's summer incident record is covered in a separate reliability review.

At a glance

Sign-in and security

Sign-in-or-up with strict enumeration protection (4 August). "Enumeration" is when an attacker types in email addresses to find out which ones have accounts. Under strict protection, <SignIn /> now sends a code or link first and only then decides whether to sign the person in or create an account. Clerk says someone probing with addresses they don't own "learns nothing either way." It requires open access mode and no username identifiers, and password cannot be the first step. Existing <SignIn /> pages pick it up without code changes. Custom flows can use a signUpIfMissing option.

Biometric sign-in for mobile (17 August). The Expo, iOS and Android SDKs can now enroll a device as a biometric credential and then sign in with Face ID, Touch ID or Android biometrics. The private key stays on the device. The prebuilt components can show the enrollment prompt and the sign-in button for you.

Configurable reverification window (28 August). Clerk asks users to prove who they are again before sensitive actions such as changing a password, removing an email address or deleting the account. The window after a successful check can now be set anywhere from 1 to 10 minutes. The default is 10.

Enterprise SSO and directories

This was the largest group of changes. It builds on self-serve SAML (26 June) and self-serve OIDC (end of July), which let a customer's IT admin set up SSO from the <OrganizationProfile /> component without contacting you.

• Google Workspace Directory Sync (5 August). Clerk pulls users, groups and memberships from Google Workspace using a service account, and can map Google groups to Clerk roles. Accounts stay in sync without anyone having to sign in first.
• Multiple enterprise connections per Organization (24 September). Before this, creating a second SAML or OIDC connection on one Organization failed with an error. Clerk suggests using it after an acquisition, during a move to a new identity provider, or when contractors sign in through a different provider. When several directories manage the same user, that user is deactivated only once every directory has removed them.
• SSO bypass (29 September). Users on an allowlist can sign in with a one-time email code when their company's identity provider is unavailable. They get a "Can't use SSO?" link in the sign-in component. Admins manage the allowlist in the Dashboard, through the Backend API, or in the Organization's Security tab. Each bypass is logged.

SSO bypass matters for reliability. If a customer's Okta or Entra tenant goes down, all their users are locked out of your app even though Clerk and your app are running normally. The allowlist gives a named set of people a way back in.

Visibility: Admin Logs and SMS logs

Admin Logs (25 August) is an audit trail of configuration changes: new OAuth applications, instance settings, rotated secrets, and roles and permissions. It is limited to Business and Enterprise plans and began recording on 24 August 2026, so earlier changes are not included.

SMS delivery in Application Logs (17 September) records each verification or reset SMS as sms.accepted, sms.delivered, sms.failed, sms.undeliverable or sms.unconfirmed, with a normalised reason when it fails. Clerk says this is on all plans, with retention depending on plan. "I never got the code" is one of the most common sign-in complaints, and now there is a record to check.

OAuth and agents

Four entries turn Clerk into a more complete OAuth authorization server, mainly for MCP servers and AI agents:

• Client ID Metadata Documents, in beta on 6 August and generally available on 21 September;
• custom OAuth scopes on 21 August;
• the OAuth Device Authorization Grant on 8 September.

We cover these in detail in Clerk's agent and MCP auth push.

Billing

Discounts and promo codes (10 August). Clerk Billing can apply percentage or fixed-amount discounts to a subscription, for one cycle, several cycles or indefinitely. It can also issue promo codes that customers redeem at checkout. Codes can be limited by total redemptions or restricted to new customers. This follows account credits (30 June) and per-seat pricing (10 June).

What it means for developers

• Nothing breaks. Every change in this period is opt-in or turned on from the Dashboard.
• Upgrade your mobile SDKs if you want biometrics or the hosted mobile sign-in added in July.
• Plan for the TLS change. In July, Clerk said it will stop supporting CBC-mode cipher suites on Clerk-managed subdomains starting 18 January 2027. Modern browsers and runtimes are not affected, but very old embedded clients may be.
• When sign-in fails, check the logs before blaming Clerk. SMS logs, email logs and SSO bypass now cover the three most common causes that have nothing to do with Clerk: carriers, mailbox providers and customer identity providers.

When the problem does look like Clerk, Clerk's live status on isuptime checks its status page every few minutes.

---

Sources

• Clerk changelog (Clerk)
• Sign-in-or-up now works with strict enumeration protection (Clerk)
• Google Workspace Directory Sync (Clerk)
• Discounts and promo codes for Billing (Clerk)
• Biometric sign-in for Expo, iOS, and Android (Clerk)
• Audit Dashboard activity with Admin Logs (Clerk)
• Customize the reverification window (Clerk)
• Trace SMS delivery in Application Logs (Clerk)
• Multiple enterprise connections per Organization (Clerk)
• SSO bypass (Clerk)
• Deprecating CBC cipher suites (Clerk)