feat(clerk-js): Add support for captcha to Signal SignUp#6574

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dstaley merged 6 commits into from
Aug 20, 2025
Merged

feat(clerk-js): Add support for captcha to Signal SignUp #6574

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
d98c7fc
feat(clerk-js): Add support for captcha to Signal SignUp
dstaley Aug 19, 2025
06b9adb
Merge branch 'main' into ds.feat/signals-signup-captcha
dstaley Aug 19, 2025
f469327
fix(clerk-js): Bump bundle limit
dstaley Aug 19, 2025
fb26e86
fix(clerk-js): Always submit captchaError to FAPI
dstaley Aug 20, 2025
9ffb2aa
Merge branch 'main' into ds.feat/signals-signup-captcha
dstaley Aug 20, 2025
724451a
Merge branch 'main' into ds.feat/signals-signup-captcha
dstaley Aug 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .changeset/blue-cloths-create.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
---
'@clerk/clerk-js': minor
---

[Experimental] Add support for captcha to Signal SignUp
27 changes: 26 additions & 1 deletion packages/clerk-js/src/core/resources/SignUp.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -8,6 +8,7 @@ import type {
AuthenticateWithPopupParams,
AuthenticateWithRedirectParams,
AuthenticateWithWeb3Params,
CaptchaWidgetType,
CreateEmailLinkFlowReturn,
PrepareEmailAddressVerificationParams,
PreparePhoneNumberVerificationParams,
Expand DownExpand Up@@ -487,11 +488,35 @@ class SignUpFuture implements SignUpFutureResource {
return this.resource.unverifiedFields;
}

private async getCaptchaToken(): Promise<{
captchaToken?: string;
captchaWidgetType?: CaptchaWidgetType;
captchaError?: unknown;
}> {
const captchaChallenge = new CaptchaChallenge(SignUp.clerk);
const response = await captchaChallenge.managedOrInvisible({ action: 'signup' });
if (!response) {
throw new Error('Captcha challenge failed');

@brkalowbrkalowAug 20, 2025

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this use ClerkRuntimeError? Or not because it's only internal?

@dstaleydstaleyAug 20, 2025

Copy link
Copy Markdown
MemberAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is me kicking that can down the road until I can do an error pass across the entire implementation 😅

@brkalowbrkalowAug 20, 2025

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Don't forget 😉

}

const { captchaError, captchaToken, captchaWidgetType } = response;
return { captchaToken, captchaWidgetType, captchaError };
}

async password({ emailAddress, password }: { emailAddress: string; password: string }): Promise<{ error: unknown }> {
return runAsyncResourceTask(this.resource, async () => {
const { captchaToken, captchaWidgetType, captchaError } = await this.getCaptchaToken();

await this.resource.__internal_basePost({
path: this.resource.pathRoot,
body: { emailAddress, password },
body: {
strategy: 'password',
emailAddress,
password,
captchaToken,
captchaWidgetType,
captchaError,
},
});
});
}
Comment on lines 506 to 522

@coderabbitaicoderabbitaiBotAug 20, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Password flow unconditionally requires CAPTCHA; bypass and retry semantics missing

As written, password() always requests a CAPTCHA token and will throw if CAPTCHA is disabled/unavailable (e.g., bypass or dev env). This diverges from create() and authenticateWithRedirectOrPopup(), which gate CAPTCHA and retry on environment/captcha errors. This will break password signup in environments where CAPTCHA is intentionally bypassed or temporarily unavailable.

Proposed fix:

  • Gate CAPTCHA retrieval on the same conditions used elsewhere (respect build flag and client bypass).
  • Retry once on CAPTCHA-related API errors after reloading the environment.
  • Spread optional captchaParams into the request body to omit absent fields.

Apply this diff:

 async password({ emailAddress, password }: { emailAddress: string; password: string }): Promise<{ error: unknown }> {
return runAsyncResourceTask(this.resource, async () => {
- const { captchaToken, captchaWidgetType, captchaError } = await this.getCaptchaToken();-- await this.resource.__internal_basePost({- path: this.resource.pathRoot,- body: {- strategy: 'password',- emailAddress,- password,- captchaToken,- captchaWidgetType,- captchaError,- },- });+ const shouldFetchCaptcha = !__BUILD_DISABLE_RHC__ && !SignUp.clerk.client?.captchaBypass;++ let captchaParams: Partial<{+ captchaToken: string;+ captchaWidgetType: CaptchaWidgetType;+ captchaError: unknown;+ }> = {};++ if (shouldFetchCaptcha) {+ captchaParams = await this.getCaptchaToken();+ }++ const post = () =>+ this.resource.__internal_basePost({+ path: this.resource.pathRoot,+ body: {+ strategy: 'password',+ emailAddress,+ password,+ ...captchaParams,+ },+ });++ try {+ await post();+ } catch (e) {+ if (isClerkAPIResponseError(e) && isCaptchaError(e)) {+ // eslint-disable-next-line @typescript-eslint/no-non-null-assertion+ await SignUp.clerk.__unstable__environment!.reload();+ if (shouldFetchCaptcha) {+ captchaParams = await this.getCaptchaToken();+ }+ await post();+ } else {+ throw e;+ }+ }
});
}
📝 Committable suggestion

‼️IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
asyncpassword({ emailAddress, password }: {emailAddress: string;password: string}): Promise<{error: unknown}>{
returnrunAsyncResourceTask(this.resource,async()=>{
const{ captchaToken, captchaWidgetType, captchaError }=awaitthis.getCaptchaToken();
awaitthis.resource.__internal_basePost({
path: this.resource.pathRoot,
body: {emailAddress,password},
body: {
strategy: 'password',
emailAddress,
password,
captchaToken,
captchaWidgetType,
captchaError,
},
});
});
}
asyncpassword({ emailAddress, password }: {emailAddress: string;password: string}): Promise<{error: unknown}>{
returnrunAsyncResourceTask(this.resource,async()=>{
constshouldFetchCaptcha=!__BUILD_DISABLE_RHC__&&!SignUp.clerk.client?.captchaBypass;
letcaptchaParams: Partial<{
captchaToken: string;
captchaWidgetType: CaptchaWidgetType;
captchaError: unknown;
}>={};
if(shouldFetchCaptcha){
captchaParams=awaitthis.getCaptchaToken();
}
constpost=()=>
this.resource.__internal_basePost({
path: this.resource.pathRoot,
body: {
strategy: 'password',
emailAddress,
password,
...captchaParams,
},
});
try{
awaitpost();
}catch(e){
if(isClerkAPIResponseError(e)&&isCaptchaError(e)){
// eslint-disable-next-line @typescript-eslint/no-non-null-assertion
awaitSignUp.clerk.__unstable__environment!.reload();
if(shouldFetchCaptcha){
captchaParams=awaitthis.getCaptchaToken();
}
awaitpost();
}else{
throwe;
}
}
});
}
🤖 Prompt for AI Agents
In packages/clerk-js/src/core/resources/SignUp.ts around lines 506-522, the
password() flow always requests a CAPTCHA token which fails in bypass/dev
environments; update it to only call getCaptchaToken when the same
CAPTCHA-enabled conditions used by create() and
authenticateWithRedirectOrPopup() are met (respecting build flags and client
bypass), spread the optional captchaParams into the POST body so absent fields
aren’t sent, and wrap the API call in a retry that, on CAPTCHA-related API
errors, reloads the environment and retries the POST once before failing.

Expand Down
9 changes: 8 additions & 1 deletion packages/clerk-js/src/utils/captcha/CaptchaChallenge.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
import type { CaptchaWidgetType } from '@clerk/types';

import type { Clerk } from '../../core/resources/internal';
import { getCaptchaToken } from './getCaptchaToken';
import { retrieveCaptchaInfo } from './retrieveCaptchaInfo';
Expand DownExpand Up@@ -42,7 +44,12 @@ export class CaptchaChallenge {
*
* Managed challenged start as non-interactive and escalate to interactive if necessary.
*/
public async managedOrInvisible(opts?: Partial<CaptchaOptions>) {
public async managedOrInvisible(
opts?: Partial<CaptchaOptions>,
): Promise<
| { captchaError?: string; captchaAction?: string; captchaToken?: string; captchaWidgetType?: CaptchaWidgetType }
| undefined
> {
const { captchaSiteKey, canUseCaptcha, captchaWidgetType, captchaProvider, captchaPublicKeyInvisible, nonce } =
retrieveCaptchaInfo(this.clerk);

Expand Down
Loading
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
feat(clerk-js): Add support for captcha to Signal SignUp#6574

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

dstaley
merged 6 commits into

from

Aug 20, 2025
 Merged


feat(clerk-js): Add support for captcha to Signal SignUp
#6574
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


6 commits


Select commit
Hold shift + click to select a range
d98c7fc

feat(clerk-js): Add support for captcha to Signal SignUp


dstaley Aug 19, 2025
06b9adb

Merge branch 'main' into ds.feat/signals-signup-captcha


dstaley Aug 19, 2025
f469327

fix(clerk-js): Bump bundle limit


dstaley Aug 19, 2025
fb26e86

fix(clerk-js): Always submit captchaError to FAPI


dstaley Aug 20, 2025
9ffb2aa

Merge branch 'main' into ds.feat/signals-signup-captcha


dstaley Aug 20, 2025
724451a

Merge branch 'main' into ds.feat/signals-signup-captcha


dstaley Aug 20, 2025

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


5 changes: 5 additions & 0 deletions
.changeset/blue-cloths-create.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
---
'@clerk/clerk-js': minor
---

[Experimental] Add support for captcha to Signal SignUp

27 changes: 26 additions & 1 deletion
packages/clerk-js/src/core/resources/SignUp.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -8,6 +8,7 @@ import type {
 AuthenticateWithPopupParams,
 AuthenticateWithRedirectParams,
 AuthenticateWithWeb3Params,
 CaptchaWidgetType,
 CreateEmailLinkFlowReturn,
 PrepareEmailAddressVerificationParams,
 PreparePhoneNumberVerificationParams,
Expand DownExpand Up@@ -487,11 +488,35 @@ class SignUpFuture implements SignUpFutureResource {
 return this.resource.unverifiedFields;
 }

 private async getCaptchaToken(): Promise<{
 captchaToken?: string;
 captchaWidgetType?: CaptchaWidgetType;
 captchaError?: unknown;
 }> {
 const captchaChallenge = new CaptchaChallenge(SignUp.clerk);
 const response = await captchaChallenge.managedOrInvisible({ action: 'signup' });
 if (!response) {
 throw new Error('Captcha challenge failed');
@brkalowbrkalowAug 20, 2025

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this use ClerkRuntimeError? Or not because it's only internal?
@dstaleydstaleyAug 20, 2025

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is me kicking that can down the road until I can do an error pass across the entire implementation 😅
@brkalowbrkalowAug 20, 2025

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Don't forget 😉
 }

 const { captchaError, captchaToken, captchaWidgetType } = response;
 return { captchaToken, captchaWidgetType, captchaError };
 }

 async password({ emailAddress, password }: { emailAddress: string; password: string }): Promise<{ error: unknown }> {
 return runAsyncResourceTask(this.resource, async () => {
 const { captchaToken, captchaWidgetType, captchaError } = await this.getCaptchaToken();

 await this.resource.__internal_basePost({
 path: this.resource.pathRoot,
 body: { emailAddress, password },
 body: {
 strategy: 'password',
 emailAddress,
 password,
 captchaToken,
 captchaWidgetType,
 captchaError,
 },
 });
 });
 }

Comment on lines

506
 to 
522

@coderabbitaicoderabbitaiBotAug 20, 2025

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue
Password flow unconditionally requires CAPTCHA; bypass and retry semantics missing
As written, password() always requests a CAPTCHA token and will throw if CAPTCHA is disabled/unavailable (e.g., bypass or dev env). This diverges from create() and authenticateWithRedirectOrPopup(), which gate CAPTCHA and retry on environment/captcha errors. This will break password signup in environments where CAPTCHA is intentionally bypassed or temporarily unavailable.
Proposed fix:
  • Gate CAPTCHA retrieval on the same conditions used elsewhere (respect build flag and client bypass).
  • Retry once on CAPTCHA-related API errors after reloading the environment.
  • Spread optional captchaParams into the request body to omit absent fields.
Apply this diff:
 async password({ emailAddress, password }: { emailAddress: string; password: string }): Promise<{ error: unknown }> {
return runAsyncResourceTask(this.resource, async () => {
- const { captchaToken, captchaWidgetType, captchaError } = await this.getCaptchaToken();-- await this.resource.__internal_basePost({- path: this.resource.pathRoot,- body: {- strategy: 'password',- emailAddress,- password,- captchaToken,- captchaWidgetType,- captchaError,- },- });+ const shouldFetchCaptcha = !__BUILD_DISABLE_RHC__ && !SignUp.clerk.client?.captchaBypass;++ let captchaParams: Partial<{+ captchaToken: string;+ captchaWidgetType: CaptchaWidgetType;+ captchaError: unknown;+ }> = {};++ if (shouldFetchCaptcha) {+ captchaParams = await this.getCaptchaToken();+ }++ const post = () =>+ this.resource.__internal_basePost({+ path: this.resource.pathRoot,+ body: {+ strategy: 'password',+ emailAddress,+ password,+ ...captchaParams,+ },+ });++ try {+ await post();+ } catch (e) {+ if (isClerkAPIResponseError(e) && isCaptchaError(e)) {+ // eslint-disable-next-line @typescript-eslint/no-non-null-assertion+ await SignUp.clerk.__unstable__environment!.reload();+ if (shouldFetchCaptcha) {+ captchaParams = await this.getCaptchaToken();+ }+ await post();+ } else {+ throw e;+ }+ }
});
}
📝 Committable suggestion
‼️IMPORTANT

Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

asyncpassword({ emailAddress, password }: {emailAddress: string;password: string}): Promise<{error: unknown}>{
returnrunAsyncResourceTask(this.resource,async()=>{
const{ captchaToken, captchaWidgetType, captchaError }=awaitthis.getCaptchaToken();
awaitthis.resource.__internal_basePost({
path: this.resource.pathRoot,
 body: {emailAddress,password},
 body: {
strategy: 'password',
emailAddress,
password,
captchaToken,
captchaWidgetType,
captchaError,
},
});
});
}
asyncpassword({ emailAddress, password }: {emailAddress: string;password: string}): Promise<{error: unknown}>{
returnrunAsyncResourceTask(this.resource,async()=>{
constshouldFetchCaptcha=!__BUILD_DISABLE_RHC__&&!SignUp.clerk.client?.captchaBypass;
letcaptchaParams: Partial<{
 captchaToken: string;
 captchaWidgetType: CaptchaWidgetType;
 captchaError: unknown;
}>={};
if(shouldFetchCaptcha){
captchaParams=awaitthis.getCaptchaToken();
}
constpost=()=>
this.resource.__internal_basePost({
path: this.resource.pathRoot,
 body: {
strategy: 'password',
emailAddress,
password,
 ...captchaParams,
},
});
try{
awaitpost();
}catch(e){
if(isClerkAPIResponseError(e)&&isCaptchaError(e)){
// eslint-disable-next-line @typescript-eslint/no-non-null-assertion
awaitSignUp.clerk.__unstable__environment!.reload();
if(shouldFetchCaptcha){
captchaParams=awaitthis.getCaptchaToken();
}
awaitpost();
}else{
throwe;
}
}
});
}
🤖 Prompt for AI Agents
In packages/clerk-js/src/core/resources/SignUp.ts around lines 506-522, the
password() flow always requests a CAPTCHA token which fails in bypass/dev
environments; update it to only call getCaptchaToken when the same
CAPTCHA-enabled conditions used by create() and
authenticateWithRedirectOrPopup() are met (respecting build flags and client
bypass), spread the optional captchaParams into the POST body so absent fields
aren’t sent, and wrap the API call in a retry that, on CAPTCHA-related API
errors, reloads the environment and retries the POST once before failing.

Expand Down

9 changes: 8 additions & 1 deletion
packages/clerk-js/src/utils/captcha/CaptchaChallenge.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
import type { CaptchaWidgetType } from '@clerk/types';

import type { Clerk } from '../../core/resources/internal';
import { getCaptchaToken } from './getCaptchaToken';
import { retrieveCaptchaInfo } from './retrieveCaptchaInfo';
Expand DownExpand Up@@ -42,7 +44,12 @@ export class CaptchaChallenge {
 *
 * Managed challenged start as non-interactive and escalate to interactive if necessary.
 */
 public async managedOrInvisible(opts?: Partial<CaptchaOptions>) {
 public async managedOrInvisible(
 opts?: Partial<CaptchaOptions>,
 ): Promise<
 | { captchaError?: string; captchaAction?: string; captchaToken?: string; captchaWidgetType?: CaptchaWidgetType }
 | undefined
 > {
 const { captchaSiteKey, canUseCaptcha, captchaWidgetType, captchaProvider, captchaPublicKeyInvisible, nonce } =
 retrieveCaptchaInfo(this.clerk);

Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(clerk-js): Add support for captcha to Signal SignUp#6574

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

dstaley
merged 6 commits into

from

Aug 20, 2025
 Merged


feat(clerk-js): Add support for captcha to Signal SignUp
#6574
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


6 commits


Select commit
Hold shift + click to select a range
d98c7fc

feat(clerk-js): Add support for captcha to Signal SignUp


dstaley Aug 19, 2025
06b9adb

Merge branch 'main' into ds.feat/signals-signup-captcha


dstaley Aug 19, 2025
f469327

fix(clerk-js): Bump bundle limit


dstaley Aug 19, 2025
fb26e86

fix(clerk-js): Always submit captchaError to FAPI


dstaley Aug 20, 2025
9ffb2aa

Merge branch 'main' into ds.feat/signals-signup-captcha


dstaley Aug 20, 2025
724451a

Merge branch 'main' into ds.feat/signals-signup-captcha


dstaley Aug 20, 2025

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


5 changes: 5 additions & 0 deletions
.changeset/blue-cloths-create.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
---
'@clerk/clerk-js': minor
---

[Experimental] Add support for captcha to Signal SignUp

27 changes: 26 additions & 1 deletion
packages/clerk-js/src/core/resources/SignUp.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -8,6 +8,7 @@ import type {
 AuthenticateWithPopupParams,
 AuthenticateWithRedirectParams,
 AuthenticateWithWeb3Params,
 CaptchaWidgetType,
 CreateEmailLinkFlowReturn,
 PrepareEmailAddressVerificationParams,
 PreparePhoneNumberVerificationParams,
Expand DownExpand Up@@ -487,11 +488,35 @@ class SignUpFuture implements SignUpFutureResource {
 return this.resource.unverifiedFields;
 }

 private async getCaptchaToken(): Promise<{
 captchaToken?: string;
 captchaWidgetType?: CaptchaWidgetType;
 captchaError?: unknown;
 }> {
 const captchaChallenge = new CaptchaChallenge(SignUp.clerk);
 const response = await captchaChallenge.managedOrInvisible({ action: 'signup' });
 if (!response) {
 throw new Error('Captcha challenge failed');
@brkalowbrkalowAug 20, 2025

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this use ClerkRuntimeError? Or not because it's only internal?
@dstaleydstaleyAug 20, 2025

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is me kicking that can down the road until I can do an error pass across the entire implementation 😅
@brkalowbrkalowAug 20, 2025

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Don't forget 😉
 }

 const { captchaError, captchaToken, captchaWidgetType } = response;
 return { captchaToken, captchaWidgetType, captchaError };
 }

 async password({ emailAddress, password }: { emailAddress: string; password: string }): Promise<{ error: unknown }> {
 return runAsyncResourceTask(this.resource, async () => {
 const { captchaToken, captchaWidgetType, captchaError } = await this.getCaptchaToken();

 await this.resource.__internal_basePost({
 path: this.resource.pathRoot,
 body: { emailAddress, password },
 body: {
 strategy: 'password',
 emailAddress,
 password,
 captchaToken,
 captchaWidgetType,
 captchaError,
 },
 });
 });
 }

Comment on lines

506
 to 
522

@coderabbitaicoderabbitaiBotAug 20, 2025

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue
Password flow unconditionally requires CAPTCHA; bypass and retry semantics missing
As written, password() always requests a CAPTCHA token and will throw if CAPTCHA is disabled/unavailable (e.g., bypass or dev env). This diverges from create() and authenticateWithRedirectOrPopup(), which gate CAPTCHA and retry on environment/captcha errors. This will break password signup in environments where CAPTCHA is intentionally bypassed or temporarily unavailable.
Proposed fix:
  • Gate CAPTCHA retrieval on the same conditions used elsewhere (respect build flag and client bypass).
  • Retry once on CAPTCHA-related API errors after reloading the environment.
  • Spread optional captchaParams into the request body to omit absent fields.
Apply this diff:
 async password({ emailAddress, password }: { emailAddress: string; password: string }): Promise<{ error: unknown }> {
return runAsyncResourceTask(this.resource, async () => {
- const { captchaToken, captchaWidgetType, captchaError } = await this.getCaptchaToken();-- await this.resource.__internal_basePost({- path: this.resource.pathRoot,- body: {- strategy: 'password',- emailAddress,- password,- captchaToken,- captchaWidgetType,- captchaError,- },- });+ const shouldFetchCaptcha = !__BUILD_DISABLE_RHC__ && !SignUp.clerk.client?.captchaBypass;++ let captchaParams: Partial<{+ captchaToken: string;+ captchaWidgetType: CaptchaWidgetType;+ captchaError: unknown;+ }> = {};++ if (shouldFetchCaptcha) {+ captchaParams = await this.getCaptchaToken();+ }++ const post = () =>+ this.resource.__internal_basePost({+ path: this.resource.pathRoot,+ body: {+ strategy: 'password',+ emailAddress,+ password,+ ...captchaParams,+ },+ });++ try {+ await post();+ } catch (e) {+ if (isClerkAPIResponseError(e) && isCaptchaError(e)) {+ // eslint-disable-next-line @typescript-eslint/no-non-null-assertion+ await SignUp.clerk.__unstable__environment!.reload();+ if (shouldFetchCaptcha) {+ captchaParams = await this.getCaptchaToken();+ }+ await post();+ } else {+ throw e;+ }+ }
});
}
📝 Committable suggestion
‼️IMPORTANT

Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

asyncpassword({ emailAddress, password }: {emailAddress: string;password: string}): Promise<{error: unknown}>{
returnrunAsyncResourceTask(this.resource,async()=>{
const{ captchaToken, captchaWidgetType, captchaError }=awaitthis.getCaptchaToken();
awaitthis.resource.__internal_basePost({
path: this.resource.pathRoot,
 body: {emailAddress,password},
 body: {
strategy: 'password',
emailAddress,
password,
captchaToken,
captchaWidgetType,
captchaError,
},
});
});
}
asyncpassword({ emailAddress, password }: {emailAddress: string;password: string}): Promise<{error: unknown}>{
returnrunAsyncResourceTask(this.resource,async()=>{
constshouldFetchCaptcha=!__BUILD_DISABLE_RHC__&&!SignUp.clerk.client?.captchaBypass;
letcaptchaParams: Partial<{
 captchaToken: string;
 captchaWidgetType: CaptchaWidgetType;
 captchaError: unknown;
}>={};
if(shouldFetchCaptcha){
captchaParams=awaitthis.getCaptchaToken();
}
constpost=()=>
this.resource.__internal_basePost({
path: this.resource.pathRoot,
 body: {
strategy: 'password',
emailAddress,
password,
 ...captchaParams,
},
});
try{
awaitpost();
}catch(e){
if(isClerkAPIResponseError(e)&&isCaptchaError(e)){
// eslint-disable-next-line @typescript-eslint/no-non-null-assertion
awaitSignUp.clerk.__unstable__environment!.reload();
if(shouldFetchCaptcha){
captchaParams=awaitthis.getCaptchaToken();
}
awaitpost();
}else{
throwe;
}
}
});
}
🤖 Prompt for AI Agents
In packages/clerk-js/src/core/resources/SignUp.ts around lines 506-522, the
password() flow always requests a CAPTCHA token which fails in bypass/dev
environments; update it to only call getCaptchaToken when the same
CAPTCHA-enabled conditions used by create() and
authenticateWithRedirectOrPopup() are met (respecting build flags and client
bypass), spread the optional captchaParams into the POST body so absent fields
aren’t sent, and wrap the API call in a retry that, on CAPTCHA-related API
errors, reloads the environment and retries the POST once before failing.

Expand Down

9 changes: 8 additions & 1 deletion
packages/clerk-js/src/utils/captcha/CaptchaChallenge.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
import type { CaptchaWidgetType } from '@clerk/types';

import type { Clerk } from '../../core/resources/internal';
import { getCaptchaToken } from './getCaptchaToken';
import { retrieveCaptchaInfo } from './retrieveCaptchaInfo';
Expand DownExpand Up@@ -42,7 +44,12 @@ export class CaptchaChallenge {
 *
 * Managed challenged start as non-interactive and escalate to interactive if necessary.
 */
 public async managedOrInvisible(opts?: Partial<CaptchaOptions>) {
 public async managedOrInvisible(
 opts?: Partial<CaptchaOptions>,
 ): Promise<
 | { captchaError?: string; captchaAction?: string; captchaToken?: string; captchaWidgetType?: CaptchaWidgetType }
 | undefined
 > {
 const { captchaSiteKey, canUseCaptcha, captchaWidgetType, captchaProvider, captchaPublicKeyInvisible, nonce } =
 retrieveCaptchaInfo(this.clerk);

Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(clerk-js): Add support for captcha to Signal SignUp#6574

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

dstaley
merged 6 commits into

from

Aug 20, 2025
 Merged


feat(clerk-js): Add support for captcha to Signal SignUp
#6574
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


6 commits


Select commit
Hold shift + click to select a range
d98c7fc

feat(clerk-js): Add support for captcha to Signal SignUp


dstaley Aug 19, 2025
06b9adb

Merge branch 'main' into ds.feat/signals-signup-captcha


dstaley Aug 19, 2025
f469327

fix(clerk-js): Bump bundle limit


dstaley Aug 19, 2025
fb26e86

fix(clerk-js): Always submit captchaError to FAPI


dstaley Aug 20, 2025
9ffb2aa

Merge branch 'main' into ds.feat/signals-signup-captcha


dstaley Aug 20, 2025
724451a

Merge branch 'main' into ds.feat/signals-signup-captcha


dstaley Aug 20, 2025

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


5 changes: 5 additions & 0 deletions
.changeset/blue-cloths-create.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
---
'@clerk/clerk-js': minor
---

[Experimental] Add support for captcha to Signal SignUp

27 changes: 26 additions & 1 deletion
packages/clerk-js/src/core/resources/SignUp.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -8,6 +8,7 @@ import type {
 AuthenticateWithPopupParams,
 AuthenticateWithRedirectParams,
 AuthenticateWithWeb3Params,
 CaptchaWidgetType,
 CreateEmailLinkFlowReturn,
 PrepareEmailAddressVerificationParams,
 PreparePhoneNumberVerificationParams,
Expand DownExpand Up@@ -487,11 +488,35 @@ class SignUpFuture implements SignUpFutureResource {
 return this.resource.unverifiedFields;
 }

 private async getCaptchaToken(): Promise<{
 captchaToken?: string;
 captchaWidgetType?: CaptchaWidgetType;
 captchaError?: unknown;
 }> {
 const captchaChallenge = new CaptchaChallenge(SignUp.clerk);
 const response = await captchaChallenge.managedOrInvisible({ action: 'signup' });
 if (!response) {
 throw new Error('Captcha challenge failed');
@brkalowbrkalowAug 20, 2025

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this use ClerkRuntimeError? Or not because it's only internal?
@dstaleydstaleyAug 20, 2025

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is me kicking that can down the road until I can do an error pass across the entire implementation 😅
@brkalowbrkalowAug 20, 2025

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Don't forget 😉
 }

 const { captchaError, captchaToken, captchaWidgetType } = response;
 return { captchaToken, captchaWidgetType, captchaError };
 }

 async password({ emailAddress, password }: { emailAddress: string; password: string }): Promise<{ error: unknown }> {
 return runAsyncResourceTask(this.resource, async () => {
 const { captchaToken, captchaWidgetType, captchaError } = await this.getCaptchaToken();

 await this.resource.__internal_basePost({
 path: this.resource.pathRoot,
 body: { emailAddress, password },
 body: {
 strategy: 'password',
 emailAddress,
 password,
 captchaToken,
 captchaWidgetType,
 captchaError,
 },
 });
 });
 }

Comment on lines

506
 to 
522

@coderabbitaicoderabbitaiBotAug 20, 2025

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue
Password flow unconditionally requires CAPTCHA; bypass and retry semantics missing
As written, password() always requests a CAPTCHA token and will throw if CAPTCHA is disabled/unavailable (e.g., bypass or dev env). This diverges from create() and authenticateWithRedirectOrPopup(), which gate CAPTCHA and retry on environment/captcha errors. This will break password signup in environments where CAPTCHA is intentionally bypassed or temporarily unavailable.
Proposed fix:
  • Gate CAPTCHA retrieval on the same conditions used elsewhere (respect build flag and client bypass).
  • Retry once on CAPTCHA-related API errors after reloading the environment.
  • Spread optional captchaParams into the request body to omit absent fields.
Apply this diff:
 async password({ emailAddress, password }: { emailAddress: string; password: string }): Promise<{ error: unknown }> {
return runAsyncResourceTask(this.resource, async () => {
- const { captchaToken, captchaWidgetType, captchaError } = await this.getCaptchaToken();-- await this.resource.__internal_basePost({- path: this.resource.pathRoot,- body: {- strategy: 'password',- emailAddress,- password,- captchaToken,- captchaWidgetType,- captchaError,- },- });+ const shouldFetchCaptcha = !__BUILD_DISABLE_RHC__ && !SignUp.clerk.client?.captchaBypass;++ let captchaParams: Partial<{+ captchaToken: string;+ captchaWidgetType: CaptchaWidgetType;+ captchaError: unknown;+ }> = {};++ if (shouldFetchCaptcha) {+ captchaParams = await this.getCaptchaToken();+ }++ const post = () =>+ this.resource.__internal_basePost({+ path: this.resource.pathRoot,+ body: {+ strategy: 'password',+ emailAddress,+ password,+ ...captchaParams,+ },+ });++ try {+ await post();+ } catch (e) {+ if (isClerkAPIResponseError(e) && isCaptchaError(e)) {+ // eslint-disable-next-line @typescript-eslint/no-non-null-assertion+ await SignUp.clerk.__unstable__environment!.reload();+ if (shouldFetchCaptcha) {+ captchaParams = await this.getCaptchaToken();+ }+ await post();+ } else {+ throw e;+ }+ }
});
}
📝 Committable suggestion
‼️IMPORTANT

Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

asyncpassword({ emailAddress, password }: {emailAddress: string;password: string}): Promise<{error: unknown}>{
returnrunAsyncResourceTask(this.resource,async()=>{
const{ captchaToken, captchaWidgetType, captchaError }=awaitthis.getCaptchaToken();
awaitthis.resource.__internal_basePost({
path: this.resource.pathRoot,
 body: {emailAddress,password},
 body: {
strategy: 'password',
emailAddress,
password,
captchaToken,
captchaWidgetType,
captchaError,
},
});
});
}
asyncpassword({ emailAddress, password }: {emailAddress: string;password: string}): Promise<{error: unknown}>{
returnrunAsyncResourceTask(this.resource,async()=>{
constshouldFetchCaptcha=!__BUILD_DISABLE_RHC__&&!SignUp.clerk.client?.captchaBypass;
letcaptchaParams: Partial<{
 captchaToken: string;
 captchaWidgetType: CaptchaWidgetType;
 captchaError: unknown;
}>={};
if(shouldFetchCaptcha){
captchaParams=awaitthis.getCaptchaToken();
}
constpost=()=>
this.resource.__internal_basePost({
path: this.resource.pathRoot,
 body: {
strategy: 'password',
emailAddress,
password,
 ...captchaParams,
},
});
try{
awaitpost();
}catch(e){
if(isClerkAPIResponseError(e)&&isCaptchaError(e)){
// eslint-disable-next-line @typescript-eslint/no-non-null-assertion
awaitSignUp.clerk.__unstable__environment!.reload();
if(shouldFetchCaptcha){
captchaParams=awaitthis.getCaptchaToken();
}
awaitpost();
}else{
throwe;
}
}
});
}
🤖 Prompt for AI Agents
In packages/clerk-js/src/core/resources/SignUp.ts around lines 506-522, the
password() flow always requests a CAPTCHA token which fails in bypass/dev
environments; update it to only call getCaptchaToken when the same
CAPTCHA-enabled conditions used by create() and
authenticateWithRedirectOrPopup() are met (respecting build flags and client
bypass), spread the optional captchaParams into the POST body so absent fields
aren’t sent, and wrap the API call in a retry that, on CAPTCHA-related API
errors, reloads the environment and retries the POST once before failing.

Expand Down

9 changes: 8 additions & 1 deletion
packages/clerk-js/src/utils/captcha/CaptchaChallenge.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
import type { CaptchaWidgetType } from '@clerk/types';

import type { Clerk } from '../../core/resources/internal';
import { getCaptchaToken } from './getCaptchaToken';
import { retrieveCaptchaInfo } from './retrieveCaptchaInfo';
Expand DownExpand Up@@ -42,7 +44,12 @@ export class CaptchaChallenge {
 *
 * Managed challenged start as non-interactive and escalate to interactive if necessary.
 */
 public async managedOrInvisible(opts?: Partial<CaptchaOptions>) {
 public async managedOrInvisible(
 opts?: Partial<CaptchaOptions>,
 ): Promise<
 | { captchaError?: string; captchaAction?: string; captchaToken?: string; captchaWidgetType?: CaptchaWidgetType }
 | undefined
 > {
 const { captchaSiteKey, canUseCaptcha, captchaWidgetType, captchaProvider, captchaPublicKeyInvisible, nonce } =
 retrieveCaptchaInfo(this.clerk);

Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
feat(clerk-js): Add support for captcha to Signal SignUp#6574

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

dstaley
merged 6 commits into

from

Aug 20, 2025
 Merged


feat(clerk-js): Add support for captcha to Signal SignUp
#6574
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


6 commits


Select commit
Hold shift + click to select a range
d98c7fc

feat(clerk-js): Add support for captcha to Signal SignUp


dstaley Aug 19, 2025
06b9adb

Merge branch 'main' into ds.feat/signals-signup-captcha


dstaley Aug 19, 2025
f469327

fix(clerk-js): Bump bundle limit


dstaley Aug 19, 2025
fb26e86

fix(clerk-js): Always submit captchaError to FAPI


dstaley Aug 20, 2025
9ffb2aa

Merge branch 'main' into ds.feat/signals-signup-captcha


dstaley Aug 20, 2025
724451a

Merge branch 'main' into ds.feat/signals-signup-captcha


dstaley Aug 20, 2025

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


5 changes: 5 additions & 0 deletions
.changeset/blue-cloths-create.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
---
'@clerk/clerk-js': minor
---

[Experimental] Add support for captcha to Signal SignUp

27 changes: 26 additions & 1 deletion
packages/clerk-js/src/core/resources/SignUp.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -8,6 +8,7 @@ import type {
 AuthenticateWithPopupParams,
 AuthenticateWithRedirectParams,
 AuthenticateWithWeb3Params,
 CaptchaWidgetType,
 CreateEmailLinkFlowReturn,
 PrepareEmailAddressVerificationParams,
 PreparePhoneNumberVerificationParams,
Expand DownExpand Up@@ -487,11 +488,35 @@ class SignUpFuture implements SignUpFutureResource {
 return this.resource.unverifiedFields;
 }

 private async getCaptchaToken(): Promise<{
 captchaToken?: string;
 captchaWidgetType?: CaptchaWidgetType;
 captchaError?: unknown;
 }> {
 const captchaChallenge = new CaptchaChallenge(SignUp.clerk);
 const response = await captchaChallenge.managedOrInvisible({ action: 'signup' });
 if (!response) {
 throw new Error('Captcha challenge failed');
@brkalowbrkalowAug 20, 2025

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this use ClerkRuntimeError? Or not because it's only internal?
@dstaleydstaleyAug 20, 2025

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is me kicking that can down the road until I can do an error pass across the entire implementation 😅
@brkalowbrkalowAug 20, 2025

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Don't forget 😉
 }

 const { captchaError, captchaToken, captchaWidgetType } = response;
 return { captchaToken, captchaWidgetType, captchaError };
 }

 async password({ emailAddress, password }: { emailAddress: string; password: string }): Promise<{ error: unknown }> {
 return runAsyncResourceTask(this.resource, async () => {
 const { captchaToken, captchaWidgetType, captchaError } = await this.getCaptchaToken();

 await this.resource.__internal_basePost({
 path: this.resource.pathRoot,
 body: { emailAddress, password },
 body: {
 strategy: 'password',
 emailAddress,
 password,
 captchaToken,
 captchaWidgetType,
 captchaError,
 },
 });
 });
 }

Comment on lines

506
 to 
522

@coderabbitaicoderabbitaiBotAug 20, 2025

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue
Password flow unconditionally requires CAPTCHA; bypass and retry semantics missing
As written, password() always requests a CAPTCHA token and will throw if CAPTCHA is disabled/unavailable (e.g., bypass or dev env). This diverges from create() and authenticateWithRedirectOrPopup(), which gate CAPTCHA and retry on environment/captcha errors. This will break password signup in environments where CAPTCHA is intentionally bypassed or temporarily unavailable.
Proposed fix:
  • Gate CAPTCHA retrieval on the same conditions used elsewhere (respect build flag and client bypass).
  • Retry once on CAPTCHA-related API errors after reloading the environment.
  • Spread optional captchaParams into the request body to omit absent fields.
Apply this diff:
 async password({ emailAddress, password }: { emailAddress: string; password: string }): Promise<{ error: unknown }> {
return runAsyncResourceTask(this.resource, async () => {
- const { captchaToken, captchaWidgetType, captchaError } = await this.getCaptchaToken();-- await this.resource.__internal_basePost({- path: this.resource.pathRoot,- body: {- strategy: 'password',- emailAddress,- password,- captchaToken,- captchaWidgetType,- captchaError,- },- });+ const shouldFetchCaptcha = !__BUILD_DISABLE_RHC__ && !SignUp.clerk.client?.captchaBypass;++ let captchaParams: Partial<{+ captchaToken: string;+ captchaWidgetType: CaptchaWidgetType;+ captchaError: unknown;+ }> = {};++ if (shouldFetchCaptcha) {+ captchaParams = await this.getCaptchaToken();+ }++ const post = () =>+ this.resource.__internal_basePost({+ path: this.resource.pathRoot,+ body: {+ strategy: 'password',+ emailAddress,+ password,+ ...captchaParams,+ },+ });++ try {+ await post();+ } catch (e) {+ if (isClerkAPIResponseError(e) && isCaptchaError(e)) {+ // eslint-disable-next-line @typescript-eslint/no-non-null-assertion+ await SignUp.clerk.__unstable__environment!.reload();+ if (shouldFetchCaptcha) {+ captchaParams = await this.getCaptchaToken();+ }+ await post();+ } else {+ throw e;+ }+ }
});
}
📝 Committable suggestion
‼️IMPORTANT

Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

asyncpassword({ emailAddress, password }: {emailAddress: string;password: string}): Promise<{error: unknown}>{
returnrunAsyncResourceTask(this.resource,async()=>{
const{ captchaToken, captchaWidgetType, captchaError }=awaitthis.getCaptchaToken();
awaitthis.resource.__internal_basePost({
path: this.resource.pathRoot,
 body: {emailAddress,password},
 body: {
strategy: 'password',
emailAddress,
password,
captchaToken,
captchaWidgetType,
captchaError,
},
});
});
}
asyncpassword({ emailAddress, password }: {emailAddress: string;password: string}): Promise<{error: unknown}>{
returnrunAsyncResourceTask(this.resource,async()=>{
constshouldFetchCaptcha=!__BUILD_DISABLE_RHC__&&!SignUp.clerk.client?.captchaBypass;
letcaptchaParams: Partial<{
 captchaToken: string;
 captchaWidgetType: CaptchaWidgetType;
 captchaError: unknown;
}>={};
if(shouldFetchCaptcha){
captchaParams=awaitthis.getCaptchaToken();
}
constpost=()=>
this.resource.__internal_basePost({
path: this.resource.pathRoot,
 body: {
strategy: 'password',
emailAddress,
password,
 ...captchaParams,
},
});
try{
awaitpost();
}catch(e){
if(isClerkAPIResponseError(e)&&isCaptchaError(e)){
// eslint-disable-next-line @typescript-eslint/no-non-null-assertion
awaitSignUp.clerk.__unstable__environment!.reload();
if(shouldFetchCaptcha){
captchaParams=awaitthis.getCaptchaToken();
}
awaitpost();
}else{
throwe;
}
}
});
}
🤖 Prompt for AI Agents
In packages/clerk-js/src/core/resources/SignUp.ts around lines 506-522, the
password() flow always requests a CAPTCHA token which fails in bypass/dev
environments; update it to only call getCaptchaToken when the same
CAPTCHA-enabled conditions used by create() and
authenticateWithRedirectOrPopup() are met (respecting build flags and client
bypass), spread the optional captchaParams into the POST body so absent fields
aren’t sent, and wrap the API call in a retry that, on CAPTCHA-related API
errors, reloads the environment and retries the POST once before failing.

Expand Down

9 changes: 8 additions & 1 deletion
packages/clerk-js/src/utils/captcha/CaptchaChallenge.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
import type { CaptchaWidgetType } from '@clerk/types';

import type { Clerk } from '../../core/resources/internal';
import { getCaptchaToken } from './getCaptchaToken';
import { retrieveCaptchaInfo } from './retrieveCaptchaInfo';
Expand DownExpand Up@@ -42,7 +44,12 @@ export class CaptchaChallenge {
 *
 * Managed challenged start as non-interactive and escalate to interactive if necessary.
 */
 public async managedOrInvisible(opts?: Partial<CaptchaOptions>) {
 public async managedOrInvisible(
 opts?: Partial<CaptchaOptions>,
 ): Promise<
 | { captchaError?: string; captchaAction?: string; captchaToken?: string; captchaWidgetType?: CaptchaWidgetType }
 | undefined
 > {
 const { captchaSiteKey, canUseCaptcha, captchaWidgetType, captchaProvider, captchaPublicKeyInvisible, nonce } =
 retrieveCaptchaInfo(this.clerk);

Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(clerk-js): Add support for captcha to Signal SignUp#6574

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

dstaley
merged 6 commits into

from

Aug 20, 2025
 Merged


feat(clerk-js): Add support for captcha to Signal SignUp
#6574
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


6 commits


Select commit
Hold shift + click to select a range
d98c7fc

feat(clerk-js): Add support for captcha to Signal SignUp


dstaley Aug 19, 2025
06b9adb

Merge branch 'main' into ds.feat/signals-signup-captcha


dstaley Aug 19, 2025
f469327

fix(clerk-js): Bump bundle limit


dstaley Aug 19, 2025
fb26e86

fix(clerk-js): Always submit captchaError to FAPI


dstaley Aug 20, 2025
9ffb2aa

Merge branch 'main' into ds.feat/signals-signup-captcha


dstaley Aug 20, 2025
724451a

Merge branch 'main' into ds.feat/signals-signup-captcha


dstaley Aug 20, 2025

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


5 changes: 5 additions & 0 deletions
.changeset/blue-cloths-create.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
---
'@clerk/clerk-js': minor
---

[Experimental] Add support for captcha to Signal SignUp

27 changes: 26 additions & 1 deletion
packages/clerk-js/src/core/resources/SignUp.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -8,6 +8,7 @@ import type {
 AuthenticateWithPopupParams,
 AuthenticateWithRedirectParams,
 AuthenticateWithWeb3Params,
 CaptchaWidgetType,
 CreateEmailLinkFlowReturn,
 PrepareEmailAddressVerificationParams,
 PreparePhoneNumberVerificationParams,
Expand DownExpand Up@@ -487,11 +488,35 @@ class SignUpFuture implements SignUpFutureResource {
 return this.resource.unverifiedFields;
 }

 private async getCaptchaToken(): Promise<{
 captchaToken?: string;
 captchaWidgetType?: CaptchaWidgetType;
 captchaError?: unknown;
 }> {
 const captchaChallenge = new CaptchaChallenge(SignUp.clerk);
 const response = await captchaChallenge.managedOrInvisible({ action: 'signup' });
 if (!response) {
 throw new Error('Captcha challenge failed');
@brkalowbrkalowAug 20, 2025

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this use ClerkRuntimeError? Or not because it's only internal?
@dstaleydstaleyAug 20, 2025

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is me kicking that can down the road until I can do an error pass across the entire implementation 😅
@brkalowbrkalowAug 20, 2025

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Don't forget 😉
 }

 const { captchaError, captchaToken, captchaWidgetType } = response;
 return { captchaToken, captchaWidgetType, captchaError };
 }

 async password({ emailAddress, password }: { emailAddress: string; password: string }): Promise<{ error: unknown }> {
 return runAsyncResourceTask(this.resource, async () => {
 const { captchaToken, captchaWidgetType, captchaError } = await this.getCaptchaToken();

 await this.resource.__internal_basePost({
 path: this.resource.pathRoot,
 body: { emailAddress, password },
 body: {
 strategy: 'password',
 emailAddress,
 password,
 captchaToken,
 captchaWidgetType,
 captchaError,
 },
 });
 });
 }

Comment on lines

506
 to 
522

@coderabbitaicoderabbitaiBotAug 20, 2025

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue
Password flow unconditionally requires CAPTCHA; bypass and retry semantics missing
As written, password() always requests a CAPTCHA token and will throw if CAPTCHA is disabled/unavailable (e.g., bypass or dev env). This diverges from create() and authenticateWithRedirectOrPopup(), which gate CAPTCHA and retry on environment/captcha errors. This will break password signup in environments where CAPTCHA is intentionally bypassed or temporarily unavailable.
Proposed fix:
  • Gate CAPTCHA retrieval on the same conditions used elsewhere (respect build flag and client bypass).
  • Retry once on CAPTCHA-related API errors after reloading the environment.
  • Spread optional captchaParams into the request body to omit absent fields.
Apply this diff:
 async password({ emailAddress, password }: { emailAddress: string; password: string }): Promise<{ error: unknown }> {
return runAsyncResourceTask(this.resource, async () => {
- const { captchaToken, captchaWidgetType, captchaError } = await this.getCaptchaToken();-- await this.resource.__internal_basePost({- path: this.resource.pathRoot,- body: {- strategy: 'password',- emailAddress,- password,- captchaToken,- captchaWidgetType,- captchaError,- },- });+ const shouldFetchCaptcha = !__BUILD_DISABLE_RHC__ && !SignUp.clerk.client?.captchaBypass;++ let captchaParams: Partial<{+ captchaToken: string;+ captchaWidgetType: CaptchaWidgetType;+ captchaError: unknown;+ }> = {};++ if (shouldFetchCaptcha) {+ captchaParams = await this.getCaptchaToken();+ }++ const post = () =>+ this.resource.__internal_basePost({+ path: this.resource.pathRoot,+ body: {+ strategy: 'password',+ emailAddress,+ password,+ ...captchaParams,+ },+ });++ try {+ await post();+ } catch (e) {+ if (isClerkAPIResponseError(e) && isCaptchaError(e)) {+ // eslint-disable-next-line @typescript-eslint/no-non-null-assertion+ await SignUp.clerk.__unstable__environment!.reload();+ if (shouldFetchCaptcha) {+ captchaParams = await this.getCaptchaToken();+ }+ await post();+ } else {+ throw e;+ }+ }
});
}
📝 Committable suggestion
‼️IMPORTANT

Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

asyncpassword({ emailAddress, password }: {emailAddress: string;password: string}): Promise<{error: unknown}>{
returnrunAsyncResourceTask(this.resource,async()=>{
const{ captchaToken, captchaWidgetType, captchaError }=awaitthis.getCaptchaToken();
awaitthis.resource.__internal_basePost({
path: this.resource.pathRoot,
 body: {emailAddress,password},
 body: {
strategy: 'password',
emailAddress,
password,
captchaToken,
captchaWidgetType,
captchaError,
},
});
});
}
asyncpassword({ emailAddress, password }: {emailAddress: string;password: string}): Promise<{error: unknown}>{
returnrunAsyncResourceTask(this.resource,async()=>{
constshouldFetchCaptcha=!__BUILD_DISABLE_RHC__&&!SignUp.clerk.client?.captchaBypass;
letcaptchaParams: Partial<{
 captchaToken: string;
 captchaWidgetType: CaptchaWidgetType;
 captchaError: unknown;
}>={};
if(shouldFetchCaptcha){
captchaParams=awaitthis.getCaptchaToken();
}
constpost=()=>
this.resource.__internal_basePost({
path: this.resource.pathRoot,
 body: {
strategy: 'password',
emailAddress,
password,
 ...captchaParams,
},
});
try{
awaitpost();
}catch(e){
if(isClerkAPIResponseError(e)&&isCaptchaError(e)){
// eslint-disable-next-line @typescript-eslint/no-non-null-assertion
awaitSignUp.clerk.__unstable__environment!.reload();
if(shouldFetchCaptcha){
captchaParams=awaitthis.getCaptchaToken();
}
awaitpost();
}else{
throwe;
}
}
});
}
🤖 Prompt for AI Agents
In packages/clerk-js/src/core/resources/SignUp.ts around lines 506-522, the
password() flow always requests a CAPTCHA token which fails in bypass/dev
environments; update it to only call getCaptchaToken when the same
CAPTCHA-enabled conditions used by create() and
authenticateWithRedirectOrPopup() are met (respecting build flags and client
bypass), spread the optional captchaParams into the POST body so absent fields
aren’t sent, and wrap the API call in a retry that, on CAPTCHA-related API
errors, reloads the environment and retries the POST once before failing.

Expand Down

9 changes: 8 additions & 1 deletion
packages/clerk-js/src/utils/captcha/CaptchaChallenge.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
import type { CaptchaWidgetType } from '@clerk/types';

import type { Clerk } from '../../core/resources/internal';
import { getCaptchaToken } from './getCaptchaToken';
import { retrieveCaptchaInfo } from './retrieveCaptchaInfo';
Expand DownExpand Up@@ -42,7 +44,12 @@ export class CaptchaChallenge {
 *
 * Managed challenged start as non-interactive and escalate to interactive if necessary.
 */
 public async managedOrInvisible(opts?: Partial<CaptchaOptions>) {
 public async managedOrInvisible(
 opts?: Partial<CaptchaOptions>,
 ): Promise<
 | { captchaError?: string; captchaAction?: string; captchaToken?: string; captchaWidgetType?: CaptchaWidgetType }
 | undefined
 > {
 const { captchaSiteKey, canUseCaptcha, captchaWidgetType, captchaProvider, captchaPublicKeyInvisible, nonce } =
 retrieveCaptchaInfo(this.clerk);

Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(clerk-js): Add support for captcha to Signal SignUp#6574

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

dstaley
merged 6 commits into

from

Aug 20, 2025
 Merged


feat(clerk-js): Add support for captcha to Signal SignUp
#6574
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


6 commits


Select commit
Hold shift + click to select a range
d98c7fc

feat(clerk-js): Add support for captcha to Signal SignUp


dstaley Aug 19, 2025
06b9adb

Merge branch 'main' into ds.feat/signals-signup-captcha


dstaley Aug 19, 2025
f469327

fix(clerk-js): Bump bundle limit


dstaley Aug 19, 2025
fb26e86

fix(clerk-js): Always submit captchaError to FAPI


dstaley Aug 20, 2025
9ffb2aa

Merge branch 'main' into ds.feat/signals-signup-captcha


dstaley Aug 20, 2025
724451a

Merge branch 'main' into ds.feat/signals-signup-captcha


dstaley Aug 20, 2025

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


5 changes: 5 additions & 0 deletions
.changeset/blue-cloths-create.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
---
'@clerk/clerk-js': minor
---

[Experimental] Add support for captcha to Signal SignUp

27 changes: 26 additions & 1 deletion
packages/clerk-js/src/core/resources/SignUp.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -8,6 +8,7 @@ import type {
 AuthenticateWithPopupParams,
 AuthenticateWithRedirectParams,
 AuthenticateWithWeb3Params,
 CaptchaWidgetType,
 CreateEmailLinkFlowReturn,
 PrepareEmailAddressVerificationParams,
 PreparePhoneNumberVerificationParams,
Expand DownExpand Up@@ -487,11 +488,35 @@ class SignUpFuture implements SignUpFutureResource {
 return this.resource.unverifiedFields;
 }

 private async getCaptchaToken(): Promise<{
 captchaToken?: string;
 captchaWidgetType?: CaptchaWidgetType;
 captchaError?: unknown;
 }> {
 const captchaChallenge = new CaptchaChallenge(SignUp.clerk);
 const response = await captchaChallenge.managedOrInvisible({ action: 'signup' });
 if (!response) {
 throw new Error('Captcha challenge failed');
@brkalowbrkalowAug 20, 2025

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this use ClerkRuntimeError? Or not because it's only internal?
@dstaleydstaleyAug 20, 2025

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is me kicking that can down the road until I can do an error pass across the entire implementation 😅
@brkalowbrkalowAug 20, 2025

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Don't forget 😉
 }

 const { captchaError, captchaToken, captchaWidgetType } = response;
 return { captchaToken, captchaWidgetType, captchaError };
 }

 async password({ emailAddress, password }: { emailAddress: string; password: string }): Promise<{ error: unknown }> {
 return runAsyncResourceTask(this.resource, async () => {
 const { captchaToken, captchaWidgetType, captchaError } = await this.getCaptchaToken();

 await this.resource.__internal_basePost({
 path: this.resource.pathRoot,
 body: { emailAddress, password },
 body: {
 strategy: 'password',
 emailAddress,
 password,
 captchaToken,
 captchaWidgetType,
 captchaError,
 },
 });
 });
 }

Comment on lines

506
 to 
522

@coderabbitaicoderabbitaiBotAug 20, 2025

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue
Password flow unconditionally requires CAPTCHA; bypass and retry semantics missing
As written, password() always requests a CAPTCHA token and will throw if CAPTCHA is disabled/unavailable (e.g., bypass or dev env). This diverges from create() and authenticateWithRedirectOrPopup(), which gate CAPTCHA and retry on environment/captcha errors. This will break password signup in environments where CAPTCHA is intentionally bypassed or temporarily unavailable.
Proposed fix:
  • Gate CAPTCHA retrieval on the same conditions used elsewhere (respect build flag and client bypass).
  • Retry once on CAPTCHA-related API errors after reloading the environment.
  • Spread optional captchaParams into the request body to omit absent fields.
Apply this diff:
 async password({ emailAddress, password }: { emailAddress: string; password: string }): Promise<{ error: unknown }> {
return runAsyncResourceTask(this.resource, async () => {
- const { captchaToken, captchaWidgetType, captchaError } = await this.getCaptchaToken();-- await this.resource.__internal_basePost({- path: this.resource.pathRoot,- body: {- strategy: 'password',- emailAddress,- password,- captchaToken,- captchaWidgetType,- captchaError,- },- });+ const shouldFetchCaptcha = !__BUILD_DISABLE_RHC__ && !SignUp.clerk.client?.captchaBypass;++ let captchaParams: Partial<{+ captchaToken: string;+ captchaWidgetType: CaptchaWidgetType;+ captchaError: unknown;+ }> = {};++ if (shouldFetchCaptcha) {+ captchaParams = await this.getCaptchaToken();+ }++ const post = () =>+ this.resource.__internal_basePost({+ path: this.resource.pathRoot,+ body: {+ strategy: 'password',+ emailAddress,+ password,+ ...captchaParams,+ },+ });++ try {+ await post();+ } catch (e) {+ if (isClerkAPIResponseError(e) && isCaptchaError(e)) {+ // eslint-disable-next-line @typescript-eslint/no-non-null-assertion+ await SignUp.clerk.__unstable__environment!.reload();+ if (shouldFetchCaptcha) {+ captchaParams = await this.getCaptchaToken();+ }+ await post();+ } else {+ throw e;+ }+ }
});
}
📝 Committable suggestion
‼️IMPORTANT

Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

asyncpassword({ emailAddress, password }: {emailAddress: string;password: string}): Promise<{error: unknown}>{
returnrunAsyncResourceTask(this.resource,async()=>{
const{ captchaToken, captchaWidgetType, captchaError }=awaitthis.getCaptchaToken();
awaitthis.resource.__internal_basePost({
path: this.resource.pathRoot,
 body: {emailAddress,password},
 body: {
strategy: 'password',
emailAddress,
password,
captchaToken,
captchaWidgetType,
captchaError,
},
});
});
}
asyncpassword({ emailAddress, password }: {emailAddress: string;password: string}): Promise<{error: unknown}>{
returnrunAsyncResourceTask(this.resource,async()=>{
constshouldFetchCaptcha=!__BUILD_DISABLE_RHC__&&!SignUp.clerk.client?.captchaBypass;
letcaptchaParams: Partial<{
 captchaToken: string;
 captchaWidgetType: CaptchaWidgetType;
 captchaError: unknown;
}>={};
if(shouldFetchCaptcha){
captchaParams=awaitthis.getCaptchaToken();
}
constpost=()=>
this.resource.__internal_basePost({
path: this.resource.pathRoot,
 body: {
strategy: 'password',
emailAddress,
password,
 ...captchaParams,
},
});
try{
awaitpost();
}catch(e){
if(isClerkAPIResponseError(e)&&isCaptchaError(e)){
// eslint-disable-next-line @typescript-eslint/no-non-null-assertion
awaitSignUp.clerk.__unstable__environment!.reload();
if(shouldFetchCaptcha){
captchaParams=awaitthis.getCaptchaToken();
}
awaitpost();
}else{
throwe;
}
}
});
}
🤖 Prompt for AI Agents
In packages/clerk-js/src/core/resources/SignUp.ts around lines 506-522, the
password() flow always requests a CAPTCHA token which fails in bypass/dev
environments; update it to only call getCaptchaToken when the same
CAPTCHA-enabled conditions used by create() and
authenticateWithRedirectOrPopup() are met (respecting build flags and client
bypass), spread the optional captchaParams into the POST body so absent fields
aren’t sent, and wrap the API call in a retry that, on CAPTCHA-related API
errors, reloads the environment and retries the POST once before failing.

Expand Down

9 changes: 8 additions & 1 deletion
packages/clerk-js/src/utils/captcha/CaptchaChallenge.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
import type { CaptchaWidgetType } from '@clerk/types';

import type { Clerk } from '../../core/resources/internal';
import { getCaptchaToken } from './getCaptchaToken';
import { retrieveCaptchaInfo } from './retrieveCaptchaInfo';
Expand DownExpand Up@@ -42,7 +44,12 @@ export class CaptchaChallenge {
 *
 * Managed challenged start as non-interactive and escalate to interactive if necessary.
 */
 public async managedOrInvisible(opts?: Partial<CaptchaOptions>) {
 public async managedOrInvisible(
 opts?: Partial<CaptchaOptions>,
 ): Promise<
 | { captchaError?: string; captchaAction?: string; captchaToken?: string; captchaWidgetType?: CaptchaWidgetType }
 | undefined
 > {
 const { captchaSiteKey, canUseCaptcha, captchaWidgetType, captchaProvider, captchaPublicKeyInvisible, nonce } =
 retrieveCaptchaInfo(this.clerk);

Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
feat(clerk-js): Add support for captcha to Signal SignUp#6574

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

dstaley
merged 6 commits into

from

Aug 20, 2025
 Merged


feat(clerk-js): Add support for captcha to Signal SignUp
#6574
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


6 commits


Select commit
Hold shift + click to select a range
d98c7fc

feat(clerk-js): Add support for captcha to Signal SignUp


dstaley Aug 19, 2025
06b9adb

Merge branch 'main' into ds.feat/signals-signup-captcha


dstaley Aug 19, 2025
f469327

fix(clerk-js): Bump bundle limit


dstaley Aug 19, 2025
fb26e86

fix(clerk-js): Always submit captchaError to FAPI


dstaley Aug 20, 2025
9ffb2aa

Merge branch 'main' into ds.feat/signals-signup-captcha


dstaley Aug 20, 2025
724451a

Merge branch 'main' into ds.feat/signals-signup-captcha


dstaley Aug 20, 2025

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


5 changes: 5 additions & 0 deletions
.changeset/blue-cloths-create.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
---
'@clerk/clerk-js': minor
---

[Experimental] Add support for captcha to Signal SignUp

27 changes: 26 additions & 1 deletion
packages/clerk-js/src/core/resources/SignUp.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -8,6 +8,7 @@ import type {
 AuthenticateWithPopupParams,
 AuthenticateWithRedirectParams,
 AuthenticateWithWeb3Params,
 CaptchaWidgetType,
 CreateEmailLinkFlowReturn,
 PrepareEmailAddressVerificationParams,
 PreparePhoneNumberVerificationParams,
Expand DownExpand Up@@ -487,11 +488,35 @@ class SignUpFuture implements SignUpFutureResource {
 return this.resource.unverifiedFields;
 }

 private async getCaptchaToken(): Promise<{
 captchaToken?: string;
 captchaWidgetType?: CaptchaWidgetType;
 captchaError?: unknown;
 }> {
 const captchaChallenge = new CaptchaChallenge(SignUp.clerk);
 const response = await captchaChallenge.managedOrInvisible({ action: 'signup' });
 if (!response) {
 throw new Error('Captcha challenge failed');
@brkalowbrkalowAug 20, 2025

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this use ClerkRuntimeError? Or not because it's only internal?
@dstaleydstaleyAug 20, 2025

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is me kicking that can down the road until I can do an error pass across the entire implementation 😅
@brkalowbrkalowAug 20, 2025

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Don't forget 😉
 }

 const { captchaError, captchaToken, captchaWidgetType } = response;
 return { captchaToken, captchaWidgetType, captchaError };
 }

 async password({ emailAddress, password }: { emailAddress: string; password: string }): Promise<{ error: unknown }> {
 return runAsyncResourceTask(this.resource, async () => {
 const { captchaToken, captchaWidgetType, captchaError } = await this.getCaptchaToken();

 await this.resource.__internal_basePost({
 path: this.resource.pathRoot,
 body: { emailAddress, password },
 body: {
 strategy: 'password',
 emailAddress,
 password,
 captchaToken,
 captchaWidgetType,
 captchaError,
 },
 });
 });
 }

Comment on lines

506
 to 
522

@coderabbitaicoderabbitaiBotAug 20, 2025

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue
Password flow unconditionally requires CAPTCHA; bypass and retry semantics missing
As written, password() always requests a CAPTCHA token and will throw if CAPTCHA is disabled/unavailable (e.g., bypass or dev env). This diverges from create() and authenticateWithRedirectOrPopup(), which gate CAPTCHA and retry on environment/captcha errors. This will break password signup in environments where CAPTCHA is intentionally bypassed or temporarily unavailable.
Proposed fix:
  • Gate CAPTCHA retrieval on the same conditions used elsewhere (respect build flag and client bypass).
  • Retry once on CAPTCHA-related API errors after reloading the environment.
  • Spread optional captchaParams into the request body to omit absent fields.
Apply this diff:
 async password({ emailAddress, password }: { emailAddress: string; password: string }): Promise<{ error: unknown }> {
return runAsyncResourceTask(this.resource, async () => {
- const { captchaToken, captchaWidgetType, captchaError } = await this.getCaptchaToken();-- await this.resource.__internal_basePost({- path: this.resource.pathRoot,- body: {- strategy: 'password',- emailAddress,- password,- captchaToken,- captchaWidgetType,- captchaError,- },- });+ const shouldFetchCaptcha = !__BUILD_DISABLE_RHC__ && !SignUp.clerk.client?.captchaBypass;++ let captchaParams: Partial<{+ captchaToken: string;+ captchaWidgetType: CaptchaWidgetType;+ captchaError: unknown;+ }> = {};++ if (shouldFetchCaptcha) {+ captchaParams = await this.getCaptchaToken();+ }++ const post = () =>+ this.resource.__internal_basePost({+ path: this.resource.pathRoot,+ body: {+ strategy: 'password',+ emailAddress,+ password,+ ...captchaParams,+ },+ });++ try {+ await post();+ } catch (e) {+ if (isClerkAPIResponseError(e) && isCaptchaError(e)) {+ // eslint-disable-next-line @typescript-eslint/no-non-null-assertion+ await SignUp.clerk.__unstable__environment!.reload();+ if (shouldFetchCaptcha) {+ captchaParams = await this.getCaptchaToken();+ }+ await post();+ } else {+ throw e;+ }+ }
});
}
📝 Committable suggestion
‼️IMPORTANT

Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

asyncpassword({ emailAddress, password }: {emailAddress: string;password: string}): Promise<{error: unknown}>{
returnrunAsyncResourceTask(this.resource,async()=>{
const{ captchaToken, captchaWidgetType, captchaError }=awaitthis.getCaptchaToken();
awaitthis.resource.__internal_basePost({
path: this.resource.pathRoot,
 body: {emailAddress,password},
 body: {
strategy: 'password',
emailAddress,
password,
captchaToken,
captchaWidgetType,
captchaError,
},
});
});
}
asyncpassword({ emailAddress, password }: {emailAddress: string;password: string}): Promise<{error: unknown}>{
returnrunAsyncResourceTask(this.resource,async()=>{
constshouldFetchCaptcha=!__BUILD_DISABLE_RHC__&&!SignUp.clerk.client?.captchaBypass;
letcaptchaParams: Partial<{
 captchaToken: string;
 captchaWidgetType: CaptchaWidgetType;
 captchaError: unknown;
}>={};
if(shouldFetchCaptcha){
captchaParams=awaitthis.getCaptchaToken();
}
constpost=()=>
this.resource.__internal_basePost({
path: this.resource.pathRoot,
 body: {
strategy: 'password',
emailAddress,
password,
 ...captchaParams,
},
});
try{
awaitpost();
}catch(e){
if(isClerkAPIResponseError(e)&&isCaptchaError(e)){
// eslint-disable-next-line @typescript-eslint/no-non-null-assertion
awaitSignUp.clerk.__unstable__environment!.reload();
if(shouldFetchCaptcha){
captchaParams=awaitthis.getCaptchaToken();
}
awaitpost();
}else{
throwe;
}
}
});
}
🤖 Prompt for AI Agents
In packages/clerk-js/src/core/resources/SignUp.ts around lines 506-522, the
password() flow always requests a CAPTCHA token which fails in bypass/dev
environments; update it to only call getCaptchaToken when the same
CAPTCHA-enabled conditions used by create() and
authenticateWithRedirectOrPopup() are met (respecting build flags and client
bypass), spread the optional captchaParams into the POST body so absent fields
aren’t sent, and wrap the API call in a retry that, on CAPTCHA-related API
errors, reloads the environment and retries the POST once before failing.

Expand Down

9 changes: 8 additions & 1 deletion
packages/clerk-js/src/utils/captcha/CaptchaChallenge.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
import type { CaptchaWidgetType } from '@clerk/types';

import type { Clerk } from '../../core/resources/internal';
import { getCaptchaToken } from './getCaptchaToken';
import { retrieveCaptchaInfo } from './retrieveCaptchaInfo';
Expand DownExpand Up@@ -42,7 +44,12 @@ export class CaptchaChallenge {
 *
 * Managed challenged start as non-interactive and escalate to interactive if necessary.
 */
 public async managedOrInvisible(opts?: Partial<CaptchaOptions>) {
 public async managedOrInvisible(
 opts?: Partial<CaptchaOptions>,
 ): Promise<
 | { captchaError?: string; captchaAction?: string; captchaToken?: string; captchaWidgetType?: CaptchaWidgetType }
 | undefined
 > {
 const { captchaSiteKey, canUseCaptcha, captchaWidgetType, captchaProvider, captchaPublicKeyInvisible, nonce } =
 retrieveCaptchaInfo(this.clerk);

Expand Down
Loading