External account flows silently drop oidcPrompt despite public type support

[sourabhrathourr]

Preliminary checks

• I reviewed the Clerk documentation.
• I searched the clerk/javascript issue tracker, including open and closed issues.
• This is a JavaScript SDK bug report rather than a general support question.

Summary

The public JavaScript types for connected-account OAuth flows accept oidcPrompt, but ClerkJS silently drops it when constructing the Frontend API request.

This affects both:

• ExternalAccountResource.reauthorize(...)
• UserResource.createExternalAccount(...)

For Google integrations that need background access, this means oidcPrompt: 'consent' does not reach the OAuth authorization request. Clerk/Google can return a short-lived access token without a refresh token when an existing Google grant is reused. The connection initially works, then getUserOauthAccessToken can fail after the access token expires with oauth_missing_refresh_token.

Reproduction

Call reauthorization on an existing Google external account:

await externalAccount.reauthorize({
 redirectUrl: '/oauth/callback',
 additionalScopes: [
 'https://www.googleapis.com/auth/calendar.readonly',
 ],
 oidcPrompt: 'consent',
});

Inspect the request to the external-account reauthorization endpoint.

Expected request body

{
 "redirect_url": "/oauth/callback",
 "additional_scope": [
 "https://www.googleapis.com/auth/calendar.readonly"
 ],
 "oidc_prompt": "consent"
}

Actual request body

{
 "redirect_url": "/oauth/callback",
 "additional_scope": [
 "https://www.googleapis.com/auth/calendar.readonly"
 ]
}

The generated Google authorization URL consequently uses Clerk's/default provider prompt behavior rather than the requested prompt=consent.

The same omission occurs when passing oidcPrompt to user.createExternalAccount(...).

Source-level evidence on current main

The parameter is part of the public reauthorization type:

javascript/packages/shared/src/types/externalAccount.ts

Lines 6 to 10 in bcbdda6

	export type ReauthorizeExternalAccountParams = {
	additionalScopes?: OAuthScope[];
	redirectUrl?: string;
	oidcPrompt?: string;
	oidcLoginHint?: string;

But the implementation only reads and serializes additionalScopes and redirectUrl:

javascript/packages/clerk-js/src/core/resources/ExternalAccount.ts

Lines 37 to 43 in bcbdda6

	reauthorize = (params: ReauthorizeExternalAccountParams): Promise<ExternalAccountResource> => {
	const { additionalScopes, redirectUrl } = params || {};
	return this._basePatch({
	action: 'reauthorize',
	body: { additional_scope: additionalScopes, redirect_url: redirectUrl },
	});

Likewise, CreateExternalAccountParams declares oidcPrompt and oidcLoginHint:

javascript/packages/shared/src/types/user.ts

Lines 397 to 403 in bcbdda6

	* The value to pass to the [OIDC `prompt` parameter](https://openid.net/specs/openid-connect-core-1_0.html#:~:text=prompt,reauthentication%20and%20consent.) in the generated OAuth redirect URL.
	*/
	oidcPrompt?: string;
	/**
	* The value to pass to the [OIDC `login_hint` parameter](https://openid.net/specs/openid-connect-core-1_0.html#:~:text=login_hint,in%20\(if%20necessary\).) in the generated OAuth redirect URL.
	*/
	oidcLoginHint?: string;

But User.createExternalAccount omits both from its destructuring and request body:

javascript/packages/clerk-js/src/core/resources/User.ts

Lines 165 to 177 in bcbdda6

	createExternalAccount = async (params: CreateExternalAccountParams): Promise<ExternalAccountResource> => {
	const { strategy, redirectUrl, additionalScopes, enterpriseConnectionId } = params || {};
	const json = (
	await BaseResource._fetch<ExternalAccountJSON>({
	path: '/me/external_accounts',
	method: 'POST',
	body: {
	strategy,
	redirect_url: redirectUrl,
	additional_scope: additionalScopes,
	enterprise_connection_id: enterpriseConnectionId,
	} as any,

The original type PR added these fields to type files, but did not update the ClerkJS resource implementations:

#4789

For comparison, Clerk's iOS SDK now sends oidc_prompt to the same external-account creation and reauthorization endpoints:

https://github.com/clerk/clerk-ios/blob/d41365666ac3be138737a57b33b30b6291b5c65b/Sources/ClerkKit/Domains/User/ExternalAccount/ExternalAccountService.swift#L21-L41

https://github.com/clerk/clerk-ios/blob/d41365666ac3be138737a57b33b30b6291b5c65b/Sources/ClerkKit/Domains/User/UserService.swift#L117-L138

Expected behavior

oidcPrompt should be serialized as oidc_prompt for external-account creation and reauthorization. If oidcLoginHint is supported by these endpoints, it should likewise be serialized; otherwise it should not be exposed by these public parameter types.

Version check

Observed in an app using:

@clerk/nextjs 6.38.2

Confirmed in the latest published ClerkJS package at the time of filing:

@clerk/clerk-js 6.25.4

The minified 6.25.4 bundle contains the same implementation:

reauthorize=e=>{
 let{additionalScopes:t,redirectUrl:a}=e||{};
 return this._basePatch({
 action:"reauthorize",
 body:{additional_scope:t,redirect_url:a}
 })
}

It is also present on current main at commit bcbdda6d7d6c6e12cf33febe17fd148c69788716.

Environment

System:
 OS: macOS 26.5.1
 CPU: arm64 Apple M4
Binaries:
 Node: 25.2.1
 npm: 11.6.2
Browsers:
 Chrome: 149.0.7827.201
npmPackages:
 @clerk/nextjs: 6.38.2

Related issue

#1827 reports a similar “works initially, then cannot refresh the Google access token” symptom, but it does not identify this parameter-serialization bug and was closed for inactivity in 2023.

[gaurijainn]

I'd like to work on this if it's still available.

[github-actions]

Hello 👋

We currently close issues after 40 days of inactivity. It's been 30 days since the last update here. If we missed this issue, please reply here. Otherwise, we'll close this issue in 10 days.

As a friendly reminder: The best way to see an issue fixed is to open a pull request. If you're not sure how to do that, please check out our contributing guide.

Thanks for being a part of the Clerk community! 🙏