clerk

Least-privilege permissions

• Restrict API key access: Store Clerk API keys in a separate, locked-down service account rather than shared developer credentials. Only grant keys to systems that actually need them.
• Limit CLI user accounts: Assign the Clerk CLI to dedicated technical staff members who manage authentication only, not general developers. Remove access when team members leave.
• Use environment-specific keys: Create separate Clerk keys for development, testing, and production environments so a compromised development key doesn't expose live user data.
• Rotate credentials regularly: Change API keys and deployment credentials every 90 days, and immediately if any team member with access leaves the company.

Network isolation

• Isolate CLI execution: Run the Clerk CLI only on secured, controlled machines (like CI/CD servers) rather than individual laptops. Restrict network access to necessary Clerk servers only.
• Encrypt local storage: Ensure the machine running the CLI uses full-disk encryption so stolen hardware cannot expose stored credentials.
• Monitor outbound connections: Watch for unexpected network traffic from systems running Clerk CLI—it should only communicate with official Clerk servers, not suspicious external addresses.
• Use VPN/private networks: When managing Clerk credentials, ensure your network connection is private and encrypted, especially on public Wi-Fi.

Monitoring

• Log all CLI activity: Keep detailed records of who ran Clerk commands, when, and what changes were made (adding users, modifying permissions, deploying updates).
• Alert on credential use: Set up automatic notifications if Clerk API keys are accessed outside normal business hours or from unexpected locations.
• Track dependency updates: Monitor for security patches in Clerk and its underlying software dependencies weekly, and apply urgent fixes within 24 hours.
• Audit user data access: Regularly review who has accessed user information (emails, names, authentication tokens) through Clerk to catch unauthorized activity early.

Red flags to watch for

• Unexpected API key exposure: If credentials appear in code repositories, error logs, or temporary files, treat it as a breach and rotate keys immediately.
• Unusual user creation patterns: Watch for sudden spikes in new user accounts or accounts created with suspicious names/emails that may indicate automated attacks or testing.
• Service disruptions: If Clerk authentication stops working without warning, verify the issue is real (check Clerk's status page) before assuming a breach; outages can lock users out temporarily.
• Suspicious software updates: If Clerk CLI or its dependencies release unexpected updates, verify changes on the official Clerk website before installing—never trust updates from unofficial sources.