RealComposer
START FREE
Upstream APIsOfficial Clerk docs

Clerk Safe & Unsafe Practices

Direct Answer

Clerk publishable keys (pk_) are meant for frontends, while secret keys (sk_) call the Backend API and must stay server-side. Verify session tokens on the server, and authorize from public or private metadata only, because unsafeMetadata can be edited by the user.

Credentials & Where They Belong

Client safe
Publishable key (pk_)

Initializes Clerk components in the browser or app.

Server only
Secret key (sk_)

Reads and manages every user, session, and organization.

Safe Practices

  • Verify session JWTs on the server

    Use networkless verification with your instance public key before trusting a user ID.

  • Store roles in private or public metadata

    Only the Backend API can write those fields, so they are safe for authorization.

Unsafe Practices

  • Authorizing from unsafeMetadata

    Users can set unsafeMetadata from the frontend and grant themselves roles.

  • Trusting a user ID sent in the request body

    Derive identity from the verified session token, not client input.

  • Calling the Backend API from client code

    It requires the secret key, which would then be public.

The RealComposer Pattern

Store CLERK_SECRET_KEY in the vault and expose a pipeline that returns only safe user fields, such as display name and plan, for a verified session.

START BUILDING FREE

Frequently Asked Questions

Q:Is the Clerk publishable key safe to expose?

Yes. It only identifies your Clerk instance to frontend SDKs.

Clerk Recipes

All Clerk recipes (4)
Frontend / WebClerk
Security & Secret Vault

Call Clerk Backend API from Client Side

To solve call clerk backend api from client side, never execute unauthenticated requests or embed private tokens directly in client bundles. RealComposer acts as a sub-10ms edge gateway running on Cloudflare Workers that securely injects credentials from your Secret Vault, normalizes responses, and prevents unauthorized API usage. Route calls through your RealComposer edge URL to guarantee complete privacy, robust origin validation, and low mobile latency.

Sub-10ms edgeView Recipe
Frontend / WebPostHogClerk
Multi-API Aggregation

Merge Clerk User Profile with Posthog Feature Flags

To solve merge clerk user profile with posthog feature flags, never execute unauthenticated requests or embed private tokens directly in client bundles. RealComposer acts as a sub-10ms edge gateway running on Cloudflare Workers that securely injects credentials from your Secret Vault, normalizes responses, and prevents unauthorized API usage. Route calls through your RealComposer edge URL to guarantee complete privacy, robust origin validation, and low mobile latency.

Sub-10ms edgeView Recipe

Related Concepts

JSON Web Token (JWT)

A JSON Web Token (JWT) is a compact, URL-safe token containing a JSON payload of claims, such as user ID and expiration, signed by the issuer. Servers verify the signature to trust the claims without a database lookup, enabling stateless authentication.

OpenID Connect (OIDC)

OpenID Connect (OIDC) is an identity layer built on OAuth 2.0 that lets applications verify who a user is. Alongside an access token, the identity provider issues a signed ID token, a JWT containing claims such as the user ID, email, and authentication time.

Principle of Least Privilege

The principle of least privilege states that every user, service, and credential should have only the minimum permissions required to perform its task. For APIs, this means using restricted keys, narrow OAuth scopes, and client tokens limited to specific endpoints.