chore(express,hono): Add machine auth integration tests

.changeset/fix-hono-getauth-accepts-token.md

@@ -0,0 +1,5 @@
+---
+'@clerk/hono': patch
+---
+
+Add support for `CLERK_MACHINE_SECRET_KEY` environment variable. This enables M2M token scope verification without needing to pass `machineSecretKey` explicitly to `clerkMiddleware()`.

integration/templates/express-vite/src/client/main.ts

@@ -9,6 +9,8 @@ document.addEventListener('DOMContentLoaded', async function () {
  await clerk.load({
  ui: { ClerkUI },
  });
+ // @ts-expect-error: Make waitForSession test utility work
+ window.Clerk = clerk;
 
  if (clerk.isSignedIn) {
  document.getElementById('app')!.innerHTML = `

integration/templates/hono-vite/src/client/main.ts

@@ -9,6 +9,8 @@ document.addEventListener('DOMContentLoaded', async function () {
  await clerk.load({
  ui: { ClerkUI },
  });
+ // @ts-expect-error: Make waitForSession test utility work
+ window.Clerk = clerk;
 
  if (clerk.isSignedIn) {
  document.getElementById('app')!.innerHTML = `

integration/tests/express/machine.test.ts

@@ -0,0 +1,142 @@
+import { test } from '@playwright/test';
+
+import { appConfigs } from '../../presets';
+import type { MachineAuthTestAdapter } from '../../testUtils/machineAuthHelpers';
+import {
+ registerApiKeyAuthTests,
+ registerM2MAuthTests,
+ registerOAuthAuthTests,
+} from '../../testUtils/machineAuthHelpers';
+
+const createMainFile = () => `
+import 'dotenv/config';
+
+import { clerkMiddleware } from '@clerk/express';
+import express from 'express';
+import ViteExpress from 'vite-express';
+import { machineRoutes } from './routes/machine';
+
+const app = express();
+
+app.use(express.json());
+app.use(
+ clerkMiddleware({
+ publishableKey: process.env.VITE_CLERK_PUBLISHABLE_KEY,
+ }),
+);
+
+app.use('/api', machineRoutes);
+
+const port = parseInt(process.env.PORT as string) || 3002;
+ViteExpress.listen(app, port, () => console.log(\`Server is listening on port \${port}...\`));
+`;
+
+const adapter: MachineAuthTestAdapter = {
+ baseConfig: appConfigs.express.vite,
+ apiKey: {
+ path: '/api/me',
+ addRoutes: config =>
+ config
+ .addFile(
+ 'src/server/routes/machine.ts',
+ () => `
+import { getAuth } from '@clerk/express';
+import { Router } from 'express';
+
+const router = Router();
+
+router.get('/me', (req: any, res: any) => {
+ const { userId, tokenType } = getAuth(req, { acceptsToken: 'api_key' });
+
+ if (!userId) {
+ res.status(401).send('Unauthorized');
+ return;
+ }
+
+ res.json({ userId, tokenType });
+});
+
+router.post('/me', (req: any, res: any) => {
+ const authObject = getAuth(req, { acceptsToken: ['api_key', 'session_token'] });
+
+ if (!authObject.isAuthenticated) {
+ res.status(401).send('Unauthorized');
+ return;
+ }
+
+ res.json({ userId: authObject.userId, tokenType: authObject.tokenType });
+});
+
+export const machineRoutes = router;
+ `,
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+ m2m: {
+ path: '/api/m2m',
+ addRoutes: config =>
+ config
+ .addFile(
+ 'src/server/routes/machine.ts',
+ () => `
+import { getAuth } from '@clerk/express';
+import { Router } from 'express';
+
+const router = Router();
+
+router.get('/m2m', (req: any, res: any) => {
+ const { subject, tokenType, machineId } = getAuth(req, { acceptsToken: 'm2m_token' });
+
+ if (!machineId) {
+ res.status(401).send('Unauthorized');
+ return;
+ }
+
+ res.json({ subject, tokenType });
+});
+
+export const machineRoutes = router;
+ `,
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+ oauth: {
+ verifyPath: '/api/oauth-verify',
+ callbackPath: '/api/oauth/callback',
+ addRoutes: config =>
+ config
+ .addFile(
+ 'src/server/routes/machine.ts',
+ () => `
+import { getAuth } from '@clerk/express';
+import { Router } from 'express';
+
+const router = Router();
+
+router.get('/oauth-verify', (req: any, res: any) => {
+ const { userId, tokenType } = getAuth(req, { acceptsToken: 'oauth_token' });
+
+ if (!userId) {
+ res.status(401).send('Unauthorized');
+ return;
+ }
+
+ res.json({ userId, tokenType });
+});
+
+router.get('/oauth/callback', (_req: any, res: any) => {
+ res.json({ message: 'OAuth callback received' });
+});
+
+export const machineRoutes = router;
+ `,
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+};
+
+test.describe('Express machine authentication @machine', () => {
+ registerApiKeyAuthTests(adapter);
+ registerM2MAuthTests(adapter);
+ registerOAuthAuthTests(adapter);
+});

integration/tests/hono/machine.test.ts

@@ -0,0 +1,128 @@
+import { test } from '@playwright/test';
+
+import { appConfigs } from '../../presets';
+import type { MachineAuthTestAdapter } from '../../testUtils/machineAuthHelpers';
+import {
+ registerApiKeyAuthTests,
+ registerM2MAuthTests,
+ registerOAuthAuthTests,
+} from '../../testUtils/machineAuthHelpers';
+
+const createAppFile = (routes: string) => `
+import { clerkMiddleware, getAuth } from '@clerk/hono';
+import { Hono } from 'hono';
+
+const app = new Hono();
+
+app.use(
+ '*',
+ clerkMiddleware({
+ publishableKey: process.env.VITE_CLERK_PUBLISHABLE_KEY,
+ }),
+);
+
+${routes}
+
+export default app;
+`;
+
+const createMainFile = () => `
+import 'dotenv/config';
+
+import { getRequestListener } from '@hono/node-server';
+import express from 'express';
+import ViteExpress from 'vite-express';
+import app from './app';
+
+const expressApp = express();
+const honoRequestListener = getRequestListener(app.fetch);
+
+expressApp.use('/api', async (req: any, res: any) => {
+ await honoRequestListener(req, res);
+});
+
+const port = parseInt(process.env.PORT as string) || 3002;
+ViteExpress.listen(expressApp, port, () => console.log(\`Server is listening on port \${port}...\`));
+`;
+
+const adapter: MachineAuthTestAdapter = {
+ baseConfig: appConfigs.hono.vite,
+ apiKey: {
+ path: '/api/me',
+ addRoutes: config =>
+ config
+ .addFile('src/server/app.ts', () =>
+ createAppFile(`
+app.get('/me', c => {
+ const { userId, tokenType } = getAuth(c, { acceptsToken: 'api_key' });
+
+ if (!userId) {
+ return c.text('Unauthorized', 401);
+ }
+
+ return c.json({ userId, tokenType });
+});
+
+app.post('/me', c => {
+ const authObject = getAuth(c, { acceptsToken: ['api_key', 'session_token'] });
+
+ if (!authObject.isAuthenticated) {
+ return c.text('Unauthorized', 401);
+ }
+
+ return c.json({ userId: authObject.userId, tokenType: authObject.tokenType });
+});
+`),
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+ m2m: {
+ path: '/api/m2m',
+ addRoutes: config =>
+ config
+ .addFile('src/server/app.ts', () =>
+ createAppFile(`
+app.get('/m2m', c => {
+ const { subject, tokenType, machineId } = getAuth(c, { acceptsToken: 'm2m_token' });
+
+ if (!machineId) {
+ return c.text('Unauthorized', 401);
+ }
+
+ return c.json({ subject, tokenType });
+});
+`),
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+ oauth: {
+ verifyPath: '/api/oauth-verify',
+ callbackPath: '/api/oauth/callback',
+ addRoutes: config =>
+ config
+ .addFile('src/server/app.ts', () =>
+ createAppFile(`
+app.get('/oauth-verify', c => {
+ const { userId, tokenType } = getAuth(c, { acceptsToken: 'oauth_token' });
+
+ if (!userId) {
+ return c.text('Unauthorized', 401);
+ }
+
+ return c.json({ userId, tokenType });
+});
+
+app.get('/oauth/callback', c => {
+ return c.json({ message: 'OAuth callback received' });
+});
+`),
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+};
+
+test.describe('Hono machine authentication @machine', () => {
+ registerApiKeyAuthTests(adapter);
+ registerM2MAuthTests(adapter);
+ registerOAuthAuthTests(adapter);
+});

packages/hono/src/clerkMiddleware.ts

@@ -11,6 +11,7 @@ import type { FrontendApiProxyOptions } from './types';
 type ClerkEnv = {
  CLERK_SECRET_KEY: string;
  CLERK_PUBLISHABLE_KEY: string;
+ CLERK_MACHINE_SECRET_KEY?: string;
  CLERK_API_URL?: string;
  CLERK_API_VERSION?: string;
 };
@@ -43,6 +44,7 @@ export const clerkMiddleware = (options?: ClerkMiddlewareOptions): MiddlewareHan
  const {
  secretKey = clerkEnv.CLERK_SECRET_KEY || '',
  publishableKey = clerkEnv.CLERK_PUBLISHABLE_KEY || '',
+ machineSecretKey = clerkEnv.CLERK_MACHINE_SECRET_KEY || '',
  apiUrl = clerkEnv.CLERK_API_URL,
  apiVersion = clerkEnv.CLERK_API_VERSION,
  frontendApiProxy,
@@ -92,13 +94,15 @@ export const clerkMiddleware = (options?: ClerkMiddlewareOptions): MiddlewareHan
  apiVersion,
  secretKey,
  publishableKey,
+ machineSecretKey,
  userAgent: `${PACKAGE_NAME}@${PACKAGE_VERSION}`,
  });
 
  const requestState = await clerkClient.authenticateRequest(c.req.raw, {
  ...rest,
  secretKey,
  publishableKey,
+ machineSecretKey,
  proxyUrl: derivedProxyUrl,
  acceptsToken: 'any',
  });
@@ -120,7 +124,7 @@ export const clerkMiddleware = (options?: ClerkMiddlewareOptions): MiddlewareHan
  const authObjectFn = ((authOptions?: AuthOptions) =>
  getAuthObjectForAcceptedToken({
  authObject: requestState.toAuth(authOptions) as AuthObject,
- acceptsToken: 'any',
+ acceptsToken: authOptions?.acceptsToken,
  })) as GetAuthFnNoRequest;
 
  c.set('clerkAuth', authObjectFn);

.changeset/fix-hono-getauth-accepts-token.md

@@ -0,0 +1,5 @@
+---
+'@clerk/hono': patch
+---
+
+Add support for `CLERK_MACHINE_SECRET_KEY` environment variable. This enables M2M token scope verification without needing to pass `machineSecretKey` explicitly to `clerkMiddleware()`.

integration/templates/express-vite/src/client/main.ts

@@ -9,6 +9,8 @@ document.addEventListener('DOMContentLoaded', async function () {
  await clerk.load({
  ui: { ClerkUI },
  });
+ // @ts-expect-error: Make waitForSession test utility work
+ window.Clerk = clerk;
 
  if (clerk.isSignedIn) {
  document.getElementById('app')!.innerHTML = `

integration/templates/hono-vite/src/client/main.ts

@@ -9,6 +9,8 @@ document.addEventListener('DOMContentLoaded', async function () {
  await clerk.load({
  ui: { ClerkUI },
  });
+ // @ts-expect-error: Make waitForSession test utility work
+ window.Clerk = clerk;
 
  if (clerk.isSignedIn) {
  document.getElementById('app')!.innerHTML = `

integration/tests/express/machine.test.ts

@@ -0,0 +1,142 @@
+import { test } from '@playwright/test';
+
+import { appConfigs } from '../../presets';
+import type { MachineAuthTestAdapter } from '../../testUtils/machineAuthHelpers';
+import {
+ registerApiKeyAuthTests,
+ registerM2MAuthTests,
+ registerOAuthAuthTests,
+} from '../../testUtils/machineAuthHelpers';
+
+const createMainFile = () => `
+import 'dotenv/config';
+
+import { clerkMiddleware } from '@clerk/express';
+import express from 'express';
+import ViteExpress from 'vite-express';
+import { machineRoutes } from './routes/machine';
+
+const app = express();
+
+app.use(express.json());
+app.use(
+ clerkMiddleware({
+ publishableKey: process.env.VITE_CLERK_PUBLISHABLE_KEY,
+ }),
+);
+
+app.use('/api', machineRoutes);
+
+const port = parseInt(process.env.PORT as string) || 3002;
+ViteExpress.listen(app, port, () => console.log(\`Server is listening on port \${port}...\`));
+`;
+
+const adapter: MachineAuthTestAdapter = {
+ baseConfig: appConfigs.express.vite,
+ apiKey: {
+ path: '/api/me',
+ addRoutes: config =>
+ config
+ .addFile(
+ 'src/server/routes/machine.ts',
+ () => `
+import { getAuth } from '@clerk/express';
+import { Router } from 'express';
+
+const router = Router();
+
+router.get('/me', (req: any, res: any) => {
+ const { userId, tokenType } = getAuth(req, { acceptsToken: 'api_key' });
+
+ if (!userId) {
+ res.status(401).send('Unauthorized');
+ return;
+ }
+
+ res.json({ userId, tokenType });
+});
+
+router.post('/me', (req: any, res: any) => {
+ const authObject = getAuth(req, { acceptsToken: ['api_key', 'session_token'] });
+
+ if (!authObject.isAuthenticated) {
+ res.status(401).send('Unauthorized');
+ return;
+ }
+
+ res.json({ userId: authObject.userId, tokenType: authObject.tokenType });
+});
+
+export const machineRoutes = router;
+ `,
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+ m2m: {
+ path: '/api/m2m',
+ addRoutes: config =>
+ config
+ .addFile(
+ 'src/server/routes/machine.ts',
+ () => `
+import { getAuth } from '@clerk/express';
+import { Router } from 'express';
+
+const router = Router();
+
+router.get('/m2m', (req: any, res: any) => {
+ const { subject, tokenType, machineId } = getAuth(req, { acceptsToken: 'm2m_token' });
+
+ if (!machineId) {
+ res.status(401).send('Unauthorized');
+ return;
+ }
+
+ res.json({ subject, tokenType });
+});
+
+export const machineRoutes = router;
+ `,
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+ oauth: {
+ verifyPath: '/api/oauth-verify',
+ callbackPath: '/api/oauth/callback',
+ addRoutes: config =>
+ config
+ .addFile(
+ 'src/server/routes/machine.ts',
+ () => `
+import { getAuth } from '@clerk/express';
+import { Router } from 'express';
+
+const router = Router();
+
+router.get('/oauth-verify', (req: any, res: any) => {
+ const { userId, tokenType } = getAuth(req, { acceptsToken: 'oauth_token' });
+
+ if (!userId) {
+ res.status(401).send('Unauthorized');
+ return;
+ }
+
+ res.json({ userId, tokenType });
+});
+
+router.get('/oauth/callback', (_req: any, res: any) => {
+ res.json({ message: 'OAuth callback received' });
+});
+
+export const machineRoutes = router;
+ `,
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+};
+
+test.describe('Express machine authentication @machine', () => {
+ registerApiKeyAuthTests(adapter);
+ registerM2MAuthTests(adapter);
+ registerOAuthAuthTests(adapter);
+});

integration/tests/hono/machine.test.ts

@@ -0,0 +1,128 @@
+import { test } from '@playwright/test';
+
+import { appConfigs } from '../../presets';
+import type { MachineAuthTestAdapter } from '../../testUtils/machineAuthHelpers';
+import {
+ registerApiKeyAuthTests,
+ registerM2MAuthTests,
+ registerOAuthAuthTests,
+} from '../../testUtils/machineAuthHelpers';
+
+const createAppFile = (routes: string) => `
+import { clerkMiddleware, getAuth } from '@clerk/hono';
+import { Hono } from 'hono';
+
+const app = new Hono();
+
+app.use(
+ '*',
+ clerkMiddleware({
+ publishableKey: process.env.VITE_CLERK_PUBLISHABLE_KEY,
+ }),
+);
+
+${routes}
+
+export default app;
+`;
+
+const createMainFile = () => `
+import 'dotenv/config';
+
+import { getRequestListener } from '@hono/node-server';
+import express from 'express';
+import ViteExpress from 'vite-express';
+import app from './app';
+
+const expressApp = express();
+const honoRequestListener = getRequestListener(app.fetch);
+
+expressApp.use('/api', async (req: any, res: any) => {
+ await honoRequestListener(req, res);
+});
+
+const port = parseInt(process.env.PORT as string) || 3002;
+ViteExpress.listen(expressApp, port, () => console.log(\`Server is listening on port \${port}...\`));
+`;
+
+const adapter: MachineAuthTestAdapter = {
+ baseConfig: appConfigs.hono.vite,
+ apiKey: {
+ path: '/api/me',
+ addRoutes: config =>
+ config
+ .addFile('src/server/app.ts', () =>
+ createAppFile(`
+app.get('/me', c => {
+ const { userId, tokenType } = getAuth(c, { acceptsToken: 'api_key' });
+
+ if (!userId) {
+ return c.text('Unauthorized', 401);
+ }
+
+ return c.json({ userId, tokenType });
+});
+
+app.post('/me', c => {
+ const authObject = getAuth(c, { acceptsToken: ['api_key', 'session_token'] });
+
+ if (!authObject.isAuthenticated) {
+ return c.text('Unauthorized', 401);
+ }
+
+ return c.json({ userId: authObject.userId, tokenType: authObject.tokenType });
+});
+`),
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+ m2m: {
+ path: '/api/m2m',
+ addRoutes: config =>
+ config
+ .addFile('src/server/app.ts', () =>
+ createAppFile(`
+app.get('/m2m', c => {
+ const { subject, tokenType, machineId } = getAuth(c, { acceptsToken: 'm2m_token' });
+
+ if (!machineId) {
+ return c.text('Unauthorized', 401);
+ }
+
+ return c.json({ subject, tokenType });
+});
+`),
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+ oauth: {
+ verifyPath: '/api/oauth-verify',
+ callbackPath: '/api/oauth/callback',
+ addRoutes: config =>
+ config
+ .addFile('src/server/app.ts', () =>
+ createAppFile(`
+app.get('/oauth-verify', c => {
+ const { userId, tokenType } = getAuth(c, { acceptsToken: 'oauth_token' });
+
+ if (!userId) {
+ return c.text('Unauthorized', 401);
+ }
+
+ return c.json({ userId, tokenType });
+});
+
+app.get('/oauth/callback', c => {
+ return c.json({ message: 'OAuth callback received' });
+});
+`),
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+};
+
+test.describe('Hono machine authentication @machine', () => {
+ registerApiKeyAuthTests(adapter);
+ registerM2MAuthTests(adapter);
+ registerOAuthAuthTests(adapter);
+});

packages/hono/src/clerkMiddleware.ts

@@ -11,6 +11,7 @@ import type { FrontendApiProxyOptions } from './types';
 type ClerkEnv = {
  CLERK_SECRET_KEY: string;
  CLERK_PUBLISHABLE_KEY: string;
+ CLERK_MACHINE_SECRET_KEY?: string;
  CLERK_API_URL?: string;
  CLERK_API_VERSION?: string;
 };
@@ -43,6 +44,7 @@ export const clerkMiddleware = (options?: ClerkMiddlewareOptions): MiddlewareHan
  const {
  secretKey = clerkEnv.CLERK_SECRET_KEY || '',
  publishableKey = clerkEnv.CLERK_PUBLISHABLE_KEY || '',
+ machineSecretKey = clerkEnv.CLERK_MACHINE_SECRET_KEY || '',
  apiUrl = clerkEnv.CLERK_API_URL,
  apiVersion = clerkEnv.CLERK_API_VERSION,
  frontendApiProxy,
@@ -92,13 +94,15 @@ export const clerkMiddleware = (options?: ClerkMiddlewareOptions): MiddlewareHan
  apiVersion,
  secretKey,
  publishableKey,
+ machineSecretKey,
  userAgent: `${PACKAGE_NAME}@${PACKAGE_VERSION}`,
  });
 
  const requestState = await clerkClient.authenticateRequest(c.req.raw, {
  ...rest,
  secretKey,
  publishableKey,
+ machineSecretKey,
  proxyUrl: derivedProxyUrl,
  acceptsToken: 'any',
  });
@@ -120,7 +124,7 @@ export const clerkMiddleware = (options?: ClerkMiddlewareOptions): MiddlewareHan
  const authObjectFn = ((authOptions?: AuthOptions) =>
  getAuthObjectForAcceptedToken({
  authObject: requestState.toAuth(authOptions) as AuthObject,
- acceptsToken: 'any',
+ acceptsToken: authOptions?.acceptsToken,
  })) as GetAuthFnNoRequest;
 
  c.set('clerkAuth', authObjectFn);

.changeset/fix-hono-getauth-accepts-token.md

@@ -0,0 +1,5 @@
+---
+'@clerk/hono': patch
+---
+
+Add support for `CLERK_MACHINE_SECRET_KEY` environment variable. This enables M2M token scope verification without needing to pass `machineSecretKey` explicitly to `clerkMiddleware()`.

integration/templates/express-vite/src/client/main.ts

@@ -9,6 +9,8 @@ document.addEventListener('DOMContentLoaded', async function () {
  await clerk.load({
  ui: { ClerkUI },
  });
+ // @ts-expect-error: Make waitForSession test utility work
+ window.Clerk = clerk;
 
  if (clerk.isSignedIn) {
  document.getElementById('app')!.innerHTML = `

integration/templates/hono-vite/src/client/main.ts

@@ -9,6 +9,8 @@ document.addEventListener('DOMContentLoaded', async function () {
  await clerk.load({
  ui: { ClerkUI },
  });
+ // @ts-expect-error: Make waitForSession test utility work
+ window.Clerk = clerk;
 
  if (clerk.isSignedIn) {
  document.getElementById('app')!.innerHTML = `

integration/tests/express/machine.test.ts

@@ -0,0 +1,142 @@
+import { test } from '@playwright/test';
+
+import { appConfigs } from '../../presets';
+import type { MachineAuthTestAdapter } from '../../testUtils/machineAuthHelpers';
+import {
+ registerApiKeyAuthTests,
+ registerM2MAuthTests,
+ registerOAuthAuthTests,
+} from '../../testUtils/machineAuthHelpers';
+
+const createMainFile = () => `
+import 'dotenv/config';
+
+import { clerkMiddleware } from '@clerk/express';
+import express from 'express';
+import ViteExpress from 'vite-express';
+import { machineRoutes } from './routes/machine';
+
+const app = express();
+
+app.use(express.json());
+app.use(
+ clerkMiddleware({
+ publishableKey: process.env.VITE_CLERK_PUBLISHABLE_KEY,
+ }),
+);
+
+app.use('/api', machineRoutes);
+
+const port = parseInt(process.env.PORT as string) || 3002;
+ViteExpress.listen(app, port, () => console.log(\`Server is listening on port \${port}...\`));
+`;
+
+const adapter: MachineAuthTestAdapter = {
+ baseConfig: appConfigs.express.vite,
+ apiKey: {
+ path: '/api/me',
+ addRoutes: config =>
+ config
+ .addFile(
+ 'src/server/routes/machine.ts',
+ () => `
+import { getAuth } from '@clerk/express';
+import { Router } from 'express';
+
+const router = Router();
+
+router.get('/me', (req: any, res: any) => {
+ const { userId, tokenType } = getAuth(req, { acceptsToken: 'api_key' });
+
+ if (!userId) {
+ res.status(401).send('Unauthorized');
+ return;
+ }
+
+ res.json({ userId, tokenType });
+});
+
+router.post('/me', (req: any, res: any) => {
+ const authObject = getAuth(req, { acceptsToken: ['api_key', 'session_token'] });
+
+ if (!authObject.isAuthenticated) {
+ res.status(401).send('Unauthorized');
+ return;
+ }
+
+ res.json({ userId: authObject.userId, tokenType: authObject.tokenType });
+});
+
+export const machineRoutes = router;
+ `,
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+ m2m: {
+ path: '/api/m2m',
+ addRoutes: config =>
+ config
+ .addFile(
+ 'src/server/routes/machine.ts',
+ () => `
+import { getAuth } from '@clerk/express';
+import { Router } from 'express';
+
+const router = Router();
+
+router.get('/m2m', (req: any, res: any) => {
+ const { subject, tokenType, machineId } = getAuth(req, { acceptsToken: 'm2m_token' });
+
+ if (!machineId) {
+ res.status(401).send('Unauthorized');
+ return;
+ }
+
+ res.json({ subject, tokenType });
+});
+
+export const machineRoutes = router;
+ `,
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+ oauth: {
+ verifyPath: '/api/oauth-verify',
+ callbackPath: '/api/oauth/callback',
+ addRoutes: config =>
+ config
+ .addFile(
+ 'src/server/routes/machine.ts',
+ () => `
+import { getAuth } from '@clerk/express';
+import { Router } from 'express';
+
+const router = Router();
+
+router.get('/oauth-verify', (req: any, res: any) => {
+ const { userId, tokenType } = getAuth(req, { acceptsToken: 'oauth_token' });
+
+ if (!userId) {
+ res.status(401).send('Unauthorized');
+ return;
+ }
+
+ res.json({ userId, tokenType });
+});
+
+router.get('/oauth/callback', (_req: any, res: any) => {
+ res.json({ message: 'OAuth callback received' });
+});
+
+export const machineRoutes = router;
+ `,
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+};
+
+test.describe('Express machine authentication @machine', () => {
+ registerApiKeyAuthTests(adapter);
+ registerM2MAuthTests(adapter);
+ registerOAuthAuthTests(adapter);
+});

integration/tests/hono/machine.test.ts

@@ -0,0 +1,128 @@
+import { test } from '@playwright/test';
+
+import { appConfigs } from '../../presets';
+import type { MachineAuthTestAdapter } from '../../testUtils/machineAuthHelpers';
+import {
+ registerApiKeyAuthTests,
+ registerM2MAuthTests,
+ registerOAuthAuthTests,
+} from '../../testUtils/machineAuthHelpers';
+
+const createAppFile = (routes: string) => `
+import { clerkMiddleware, getAuth } from '@clerk/hono';
+import { Hono } from 'hono';
+
+const app = new Hono();
+
+app.use(
+ '*',
+ clerkMiddleware({
+ publishableKey: process.env.VITE_CLERK_PUBLISHABLE_KEY,
+ }),
+);
+
+${routes}
+
+export default app;
+`;
+
+const createMainFile = () => `
+import 'dotenv/config';
+
+import { getRequestListener } from '@hono/node-server';
+import express from 'express';
+import ViteExpress from 'vite-express';
+import app from './app';
+
+const expressApp = express();
+const honoRequestListener = getRequestListener(app.fetch);
+
+expressApp.use('/api', async (req: any, res: any) => {
+ await honoRequestListener(req, res);
+});
+
+const port = parseInt(process.env.PORT as string) || 3002;
+ViteExpress.listen(expressApp, port, () => console.log(\`Server is listening on port \${port}...\`));
+`;
+
+const adapter: MachineAuthTestAdapter = {
+ baseConfig: appConfigs.hono.vite,
+ apiKey: {
+ path: '/api/me',
+ addRoutes: config =>
+ config
+ .addFile('src/server/app.ts', () =>
+ createAppFile(`
+app.get('/me', c => {
+ const { userId, tokenType } = getAuth(c, { acceptsToken: 'api_key' });
+
+ if (!userId) {
+ return c.text('Unauthorized', 401);
+ }
+
+ return c.json({ userId, tokenType });
+});
+
+app.post('/me', c => {
+ const authObject = getAuth(c, { acceptsToken: ['api_key', 'session_token'] });
+
+ if (!authObject.isAuthenticated) {
+ return c.text('Unauthorized', 401);
+ }
+
+ return c.json({ userId: authObject.userId, tokenType: authObject.tokenType });
+});
+`),
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+ m2m: {
+ path: '/api/m2m',
+ addRoutes: config =>
+ config
+ .addFile('src/server/app.ts', () =>
+ createAppFile(`
+app.get('/m2m', c => {
+ const { subject, tokenType, machineId } = getAuth(c, { acceptsToken: 'm2m_token' });
+
+ if (!machineId) {
+ return c.text('Unauthorized', 401);
+ }
+
+ return c.json({ subject, tokenType });
+});
+`),
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+ oauth: {
+ verifyPath: '/api/oauth-verify',
+ callbackPath: '/api/oauth/callback',
+ addRoutes: config =>
+ config
+ .addFile('src/server/app.ts', () =>
+ createAppFile(`
+app.get('/oauth-verify', c => {
+ const { userId, tokenType } = getAuth(c, { acceptsToken: 'oauth_token' });
+
+ if (!userId) {
+ return c.text('Unauthorized', 401);
+ }
+
+ return c.json({ userId, tokenType });
+});
+
+app.get('/oauth/callback', c => {
+ return c.json({ message: 'OAuth callback received' });
+});
+`),
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+};
+
+test.describe('Hono machine authentication @machine', () => {
+ registerApiKeyAuthTests(adapter);
+ registerM2MAuthTests(adapter);
+ registerOAuthAuthTests(adapter);
+});

packages/hono/src/clerkMiddleware.ts

@@ -11,6 +11,7 @@ import type { FrontendApiProxyOptions } from './types';
 type ClerkEnv = {
  CLERK_SECRET_KEY: string;
  CLERK_PUBLISHABLE_KEY: string;
+ CLERK_MACHINE_SECRET_KEY?: string;
  CLERK_API_URL?: string;
  CLERK_API_VERSION?: string;
 };
@@ -43,6 +44,7 @@ export const clerkMiddleware = (options?: ClerkMiddlewareOptions): MiddlewareHan
  const {
  secretKey = clerkEnv.CLERK_SECRET_KEY || '',
  publishableKey = clerkEnv.CLERK_PUBLISHABLE_KEY || '',
+ machineSecretKey = clerkEnv.CLERK_MACHINE_SECRET_KEY || '',
  apiUrl = clerkEnv.CLERK_API_URL,
  apiVersion = clerkEnv.CLERK_API_VERSION,
  frontendApiProxy,
@@ -92,13 +94,15 @@ export const clerkMiddleware = (options?: ClerkMiddlewareOptions): MiddlewareHan
  apiVersion,
  secretKey,
  publishableKey,
+ machineSecretKey,
  userAgent: `${PACKAGE_NAME}@${PACKAGE_VERSION}`,
  });
 
  const requestState = await clerkClient.authenticateRequest(c.req.raw, {
  ...rest,
  secretKey,
  publishableKey,
+ machineSecretKey,
  proxyUrl: derivedProxyUrl,
  acceptsToken: 'any',
  });
@@ -120,7 +124,7 @@ export const clerkMiddleware = (options?: ClerkMiddlewareOptions): MiddlewareHan
  const authObjectFn = ((authOptions?: AuthOptions) =>
  getAuthObjectForAcceptedToken({
  authObject: requestState.toAuth(authOptions) as AuthObject,
- acceptsToken: 'any',
+ acceptsToken: authOptions?.acceptsToken,
  })) as GetAuthFnNoRequest;
 
  c.set('clerkAuth', authObjectFn);

.changeset/fix-hono-getauth-accepts-token.md

@@ -0,0 +1,5 @@
+---
+'@clerk/hono': patch
+---
+
+Add support for `CLERK_MACHINE_SECRET_KEY` environment variable. This enables M2M token scope verification without needing to pass `machineSecretKey` explicitly to `clerkMiddleware()`.

integration/templates/express-vite/src/client/main.ts

@@ -9,6 +9,8 @@ document.addEventListener('DOMContentLoaded', async function () {
  await clerk.load({
  ui: { ClerkUI },
  });
+ // @ts-expect-error: Make waitForSession test utility work
+ window.Clerk = clerk;
 
  if (clerk.isSignedIn) {
  document.getElementById('app')!.innerHTML = `

integration/templates/hono-vite/src/client/main.ts

@@ -9,6 +9,8 @@ document.addEventListener('DOMContentLoaded', async function () {
  await clerk.load({
  ui: { ClerkUI },
  });
+ // @ts-expect-error: Make waitForSession test utility work
+ window.Clerk = clerk;
 
  if (clerk.isSignedIn) {
  document.getElementById('app')!.innerHTML = `

integration/tests/express/machine.test.ts

@@ -0,0 +1,142 @@
+import { test } from '@playwright/test';
+
+import { appConfigs } from '../../presets';
+import type { MachineAuthTestAdapter } from '../../testUtils/machineAuthHelpers';
+import {
+ registerApiKeyAuthTests,
+ registerM2MAuthTests,
+ registerOAuthAuthTests,
+} from '../../testUtils/machineAuthHelpers';
+
+const createMainFile = () => `
+import 'dotenv/config';
+
+import { clerkMiddleware } from '@clerk/express';
+import express from 'express';
+import ViteExpress from 'vite-express';
+import { machineRoutes } from './routes/machine';
+
+const app = express();
+
+app.use(express.json());
+app.use(
+ clerkMiddleware({
+ publishableKey: process.env.VITE_CLERK_PUBLISHABLE_KEY,
+ }),
+);
+
+app.use('/api', machineRoutes);
+
+const port = parseInt(process.env.PORT as string) || 3002;
+ViteExpress.listen(app, port, () => console.log(\`Server is listening on port \${port}...\`));
+`;
+
+const adapter: MachineAuthTestAdapter = {
+ baseConfig: appConfigs.express.vite,
+ apiKey: {
+ path: '/api/me',
+ addRoutes: config =>
+ config
+ .addFile(
+ 'src/server/routes/machine.ts',
+ () => `
+import { getAuth } from '@clerk/express';
+import { Router } from 'express';
+
+const router = Router();
+
+router.get('/me', (req: any, res: any) => {
+ const { userId, tokenType } = getAuth(req, { acceptsToken: 'api_key' });
+
+ if (!userId) {
+ res.status(401).send('Unauthorized');
+ return;
+ }
+
+ res.json({ userId, tokenType });
+});
+
+router.post('/me', (req: any, res: any) => {
+ const authObject = getAuth(req, { acceptsToken: ['api_key', 'session_token'] });
+
+ if (!authObject.isAuthenticated) {
+ res.status(401).send('Unauthorized');
+ return;
+ }
+
+ res.json({ userId: authObject.userId, tokenType: authObject.tokenType });
+});
+
+export const machineRoutes = router;
+ `,
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+ m2m: {
+ path: '/api/m2m',
+ addRoutes: config =>
+ config
+ .addFile(
+ 'src/server/routes/machine.ts',
+ () => `
+import { getAuth } from '@clerk/express';
+import { Router } from 'express';
+
+const router = Router();
+
+router.get('/m2m', (req: any, res: any) => {
+ const { subject, tokenType, machineId } = getAuth(req, { acceptsToken: 'm2m_token' });
+
+ if (!machineId) {
+ res.status(401).send('Unauthorized');
+ return;
+ }
+
+ res.json({ subject, tokenType });
+});
+
+export const machineRoutes = router;
+ `,
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+ oauth: {
+ verifyPath: '/api/oauth-verify',
+ callbackPath: '/api/oauth/callback',
+ addRoutes: config =>
+ config
+ .addFile(
+ 'src/server/routes/machine.ts',
+ () => `
+import { getAuth } from '@clerk/express';
+import { Router } from 'express';
+
+const router = Router();
+
+router.get('/oauth-verify', (req: any, res: any) => {
+ const { userId, tokenType } = getAuth(req, { acceptsToken: 'oauth_token' });
+
+ if (!userId) {
+ res.status(401).send('Unauthorized');
+ return;
+ }
+
+ res.json({ userId, tokenType });
+});
+
+router.get('/oauth/callback', (_req: any, res: any) => {
+ res.json({ message: 'OAuth callback received' });
+});
+
+export const machineRoutes = router;
+ `,
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+};
+
+test.describe('Express machine authentication @machine', () => {
+ registerApiKeyAuthTests(adapter);
+ registerM2MAuthTests(adapter);
+ registerOAuthAuthTests(adapter);
+});

integration/tests/hono/machine.test.ts

@@ -0,0 +1,128 @@
+import { test } from '@playwright/test';
+
+import { appConfigs } from '../../presets';
+import type { MachineAuthTestAdapter } from '../../testUtils/machineAuthHelpers';
+import {
+ registerApiKeyAuthTests,
+ registerM2MAuthTests,
+ registerOAuthAuthTests,
+} from '../../testUtils/machineAuthHelpers';
+
+const createAppFile = (routes: string) => `
+import { clerkMiddleware, getAuth } from '@clerk/hono';
+import { Hono } from 'hono';
+
+const app = new Hono();
+
+app.use(
+ '*',
+ clerkMiddleware({
+ publishableKey: process.env.VITE_CLERK_PUBLISHABLE_KEY,
+ }),
+);
+
+${routes}
+
+export default app;
+`;
+
+const createMainFile = () => `
+import 'dotenv/config';
+
+import { getRequestListener } from '@hono/node-server';
+import express from 'express';
+import ViteExpress from 'vite-express';
+import app from './app';
+
+const expressApp = express();
+const honoRequestListener = getRequestListener(app.fetch);
+
+expressApp.use('/api', async (req: any, res: any) => {
+ await honoRequestListener(req, res);
+});
+
+const port = parseInt(process.env.PORT as string) || 3002;
+ViteExpress.listen(expressApp, port, () => console.log(\`Server is listening on port \${port}...\`));
+`;
+
+const adapter: MachineAuthTestAdapter = {
+ baseConfig: appConfigs.hono.vite,
+ apiKey: {
+ path: '/api/me',
+ addRoutes: config =>
+ config
+ .addFile('src/server/app.ts', () =>
+ createAppFile(`
+app.get('/me', c => {
+ const { userId, tokenType } = getAuth(c, { acceptsToken: 'api_key' });
+
+ if (!userId) {
+ return c.text('Unauthorized', 401);
+ }
+
+ return c.json({ userId, tokenType });
+});
+
+app.post('/me', c => {
+ const authObject = getAuth(c, { acceptsToken: ['api_key', 'session_token'] });
+
+ if (!authObject.isAuthenticated) {
+ return c.text('Unauthorized', 401);
+ }
+
+ return c.json({ userId: authObject.userId, tokenType: authObject.tokenType });
+});
+`),
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+ m2m: {
+ path: '/api/m2m',
+ addRoutes: config =>
+ config
+ .addFile('src/server/app.ts', () =>
+ createAppFile(`
+app.get('/m2m', c => {
+ const { subject, tokenType, machineId } = getAuth(c, { acceptsToken: 'm2m_token' });
+
+ if (!machineId) {
+ return c.text('Unauthorized', 401);
+ }
+
+ return c.json({ subject, tokenType });
+});
+`),
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+ oauth: {
+ verifyPath: '/api/oauth-verify',
+ callbackPath: '/api/oauth/callback',
+ addRoutes: config =>
+ config
+ .addFile('src/server/app.ts', () =>
+ createAppFile(`
+app.get('/oauth-verify', c => {
+ const { userId, tokenType } = getAuth(c, { acceptsToken: 'oauth_token' });
+
+ if (!userId) {
+ return c.text('Unauthorized', 401);
+ }
+
+ return c.json({ userId, tokenType });
+});
+
+app.get('/oauth/callback', c => {
+ return c.json({ message: 'OAuth callback received' });
+});
+`),
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+};
+
+test.describe('Hono machine authentication @machine', () => {
+ registerApiKeyAuthTests(adapter);
+ registerM2MAuthTests(adapter);
+ registerOAuthAuthTests(adapter);
+});

packages/hono/src/clerkMiddleware.ts

@@ -11,6 +11,7 @@ import type { FrontendApiProxyOptions } from './types';
 type ClerkEnv = {
  CLERK_SECRET_KEY: string;
  CLERK_PUBLISHABLE_KEY: string;
+ CLERK_MACHINE_SECRET_KEY?: string;
  CLERK_API_URL?: string;
  CLERK_API_VERSION?: string;
 };
@@ -43,6 +44,7 @@ export const clerkMiddleware = (options?: ClerkMiddlewareOptions): MiddlewareHan
  const {
  secretKey = clerkEnv.CLERK_SECRET_KEY || '',
  publishableKey = clerkEnv.CLERK_PUBLISHABLE_KEY || '',
+ machineSecretKey = clerkEnv.CLERK_MACHINE_SECRET_KEY || '',
  apiUrl = clerkEnv.CLERK_API_URL,
  apiVersion = clerkEnv.CLERK_API_VERSION,
  frontendApiProxy,
@@ -92,13 +94,15 @@ export const clerkMiddleware = (options?: ClerkMiddlewareOptions): MiddlewareHan
  apiVersion,
  secretKey,
  publishableKey,
+ machineSecretKey,
  userAgent: `${PACKAGE_NAME}@${PACKAGE_VERSION}`,
  });
 
  const requestState = await clerkClient.authenticateRequest(c.req.raw, {
  ...rest,
  secretKey,
  publishableKey,
+ machineSecretKey,
  proxyUrl: derivedProxyUrl,
  acceptsToken: 'any',
  });
@@ -120,7 +124,7 @@ export const clerkMiddleware = (options?: ClerkMiddlewareOptions): MiddlewareHan
  const authObjectFn = ((authOptions?: AuthOptions) =>
  getAuthObjectForAcceptedToken({
  authObject: requestState.toAuth(authOptions) as AuthObject,
- acceptsToken: 'any',
+ acceptsToken: authOptions?.acceptsToken,
  })) as GetAuthFnNoRequest;
 
  c.set('clerkAuth', authObjectFn);

.changeset/fix-hono-getauth-accepts-token.md

@@ -0,0 +1,5 @@
+---
+'@clerk/hono': patch
+---
+
+Add support for `CLERK_MACHINE_SECRET_KEY` environment variable. This enables M2M token scope verification without needing to pass `machineSecretKey` explicitly to `clerkMiddleware()`.

integration/templates/express-vite/src/client/main.ts

@@ -9,6 +9,8 @@ document.addEventListener('DOMContentLoaded', async function () {
  await clerk.load({
  ui: { ClerkUI },
  });
+ // @ts-expect-error: Make waitForSession test utility work
+ window.Clerk = clerk;
 
  if (clerk.isSignedIn) {
  document.getElementById('app')!.innerHTML = `

integration/templates/hono-vite/src/client/main.ts

@@ -9,6 +9,8 @@ document.addEventListener('DOMContentLoaded', async function () {
  await clerk.load({
  ui: { ClerkUI },
  });
+ // @ts-expect-error: Make waitForSession test utility work
+ window.Clerk = clerk;
 
  if (clerk.isSignedIn) {
  document.getElementById('app')!.innerHTML = `

integration/tests/express/machine.test.ts

@@ -0,0 +1,142 @@
+import { test } from '@playwright/test';
+
+import { appConfigs } from '../../presets';
+import type { MachineAuthTestAdapter } from '../../testUtils/machineAuthHelpers';
+import {
+ registerApiKeyAuthTests,
+ registerM2MAuthTests,
+ registerOAuthAuthTests,
+} from '../../testUtils/machineAuthHelpers';
+
+const createMainFile = () => `
+import 'dotenv/config';
+
+import { clerkMiddleware } from '@clerk/express';
+import express from 'express';
+import ViteExpress from 'vite-express';
+import { machineRoutes } from './routes/machine';
+
+const app = express();
+
+app.use(express.json());
+app.use(
+ clerkMiddleware({
+ publishableKey: process.env.VITE_CLERK_PUBLISHABLE_KEY,
+ }),
+);
+
+app.use('/api', machineRoutes);
+
+const port = parseInt(process.env.PORT as string) || 3002;
+ViteExpress.listen(app, port, () => console.log(\`Server is listening on port \${port}...\`));
+`;
+
+const adapter: MachineAuthTestAdapter = {
+ baseConfig: appConfigs.express.vite,
+ apiKey: {
+ path: '/api/me',
+ addRoutes: config =>
+ config
+ .addFile(
+ 'src/server/routes/machine.ts',
+ () => `
+import { getAuth } from '@clerk/express';
+import { Router } from 'express';
+
+const router = Router();
+
+router.get('/me', (req: any, res: any) => {
+ const { userId, tokenType } = getAuth(req, { acceptsToken: 'api_key' });
+
+ if (!userId) {
+ res.status(401).send('Unauthorized');
+ return;
+ }
+
+ res.json({ userId, tokenType });
+});
+
+router.post('/me', (req: any, res: any) => {
+ const authObject = getAuth(req, { acceptsToken: ['api_key', 'session_token'] });
+
+ if (!authObject.isAuthenticated) {
+ res.status(401).send('Unauthorized');
+ return;
+ }
+
+ res.json({ userId: authObject.userId, tokenType: authObject.tokenType });
+});
+
+export const machineRoutes = router;
+ `,
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+ m2m: {
+ path: '/api/m2m',
+ addRoutes: config =>
+ config
+ .addFile(
+ 'src/server/routes/machine.ts',
+ () => `
+import { getAuth } from '@clerk/express';
+import { Router } from 'express';
+
+const router = Router();
+
+router.get('/m2m', (req: any, res: any) => {
+ const { subject, tokenType, machineId } = getAuth(req, { acceptsToken: 'm2m_token' });
+
+ if (!machineId) {
+ res.status(401).send('Unauthorized');
+ return;
+ }
+
+ res.json({ subject, tokenType });
+});
+
+export const machineRoutes = router;
+ `,
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+ oauth: {
+ verifyPath: '/api/oauth-verify',
+ callbackPath: '/api/oauth/callback',
+ addRoutes: config =>
+ config
+ .addFile(
+ 'src/server/routes/machine.ts',
+ () => `
+import { getAuth } from '@clerk/express';
+import { Router } from 'express';
+
+const router = Router();
+
+router.get('/oauth-verify', (req: any, res: any) => {
+ const { userId, tokenType } = getAuth(req, { acceptsToken: 'oauth_token' });
+
+ if (!userId) {
+ res.status(401).send('Unauthorized');
+ return;
+ }
+
+ res.json({ userId, tokenType });
+});
+
+router.get('/oauth/callback', (_req: any, res: any) => {
+ res.json({ message: 'OAuth callback received' });
+});
+
+export const machineRoutes = router;
+ `,
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+};
+
+test.describe('Express machine authentication @machine', () => {
+ registerApiKeyAuthTests(adapter);
+ registerM2MAuthTests(adapter);
+ registerOAuthAuthTests(adapter);
+});

integration/tests/hono/machine.test.ts

@@ -0,0 +1,128 @@
+import { test } from '@playwright/test';
+
+import { appConfigs } from '../../presets';
+import type { MachineAuthTestAdapter } from '../../testUtils/machineAuthHelpers';
+import {
+ registerApiKeyAuthTests,
+ registerM2MAuthTests,
+ registerOAuthAuthTests,
+} from '../../testUtils/machineAuthHelpers';
+
+const createAppFile = (routes: string) => `
+import { clerkMiddleware, getAuth } from '@clerk/hono';
+import { Hono } from 'hono';
+
+const app = new Hono();
+
+app.use(
+ '*',
+ clerkMiddleware({
+ publishableKey: process.env.VITE_CLERK_PUBLISHABLE_KEY,
+ }),
+);
+
+${routes}
+
+export default app;
+`;
+
+const createMainFile = () => `
+import 'dotenv/config';
+
+import { getRequestListener } from '@hono/node-server';
+import express from 'express';
+import ViteExpress from 'vite-express';
+import app from './app';
+
+const expressApp = express();
+const honoRequestListener = getRequestListener(app.fetch);
+
+expressApp.use('/api', async (req: any, res: any) => {
+ await honoRequestListener(req, res);
+});
+
+const port = parseInt(process.env.PORT as string) || 3002;
+ViteExpress.listen(expressApp, port, () => console.log(\`Server is listening on port \${port}...\`));
+`;
+
+const adapter: MachineAuthTestAdapter = {
+ baseConfig: appConfigs.hono.vite,
+ apiKey: {
+ path: '/api/me',
+ addRoutes: config =>
+ config
+ .addFile('src/server/app.ts', () =>
+ createAppFile(`
+app.get('/me', c => {
+ const { userId, tokenType } = getAuth(c, { acceptsToken: 'api_key' });
+
+ if (!userId) {
+ return c.text('Unauthorized', 401);
+ }
+
+ return c.json({ userId, tokenType });
+});
+
+app.post('/me', c => {
+ const authObject = getAuth(c, { acceptsToken: ['api_key', 'session_token'] });
+
+ if (!authObject.isAuthenticated) {
+ return c.text('Unauthorized', 401);
+ }
+
+ return c.json({ userId: authObject.userId, tokenType: authObject.tokenType });
+});
+`),
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+ m2m: {
+ path: '/api/m2m',
+ addRoutes: config =>
+ config
+ .addFile('src/server/app.ts', () =>
+ createAppFile(`
+app.get('/m2m', c => {
+ const { subject, tokenType, machineId } = getAuth(c, { acceptsToken: 'm2m_token' });
+
+ if (!machineId) {
+ return c.text('Unauthorized', 401);
+ }
+
+ return c.json({ subject, tokenType });
+});
+`),
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+ oauth: {
+ verifyPath: '/api/oauth-verify',
+ callbackPath: '/api/oauth/callback',
+ addRoutes: config =>
+ config
+ .addFile('src/server/app.ts', () =>
+ createAppFile(`
+app.get('/oauth-verify', c => {
+ const { userId, tokenType } = getAuth(c, { acceptsToken: 'oauth_token' });
+
+ if (!userId) {
+ return c.text('Unauthorized', 401);
+ }
+
+ return c.json({ userId, tokenType });
+});
+
+app.get('/oauth/callback', c => {
+ return c.json({ message: 'OAuth callback received' });
+});
+`),
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+};
+
+test.describe('Hono machine authentication @machine', () => {
+ registerApiKeyAuthTests(adapter);
+ registerM2MAuthTests(adapter);
+ registerOAuthAuthTests(adapter);
+});

packages/hono/src/clerkMiddleware.ts

@@ -11,6 +11,7 @@ import type { FrontendApiProxyOptions } from './types';
 type ClerkEnv = {
  CLERK_SECRET_KEY: string;
  CLERK_PUBLISHABLE_KEY: string;
+ CLERK_MACHINE_SECRET_KEY?: string;
  CLERK_API_URL?: string;
  CLERK_API_VERSION?: string;
 };
@@ -43,6 +44,7 @@ export const clerkMiddleware = (options?: ClerkMiddlewareOptions): MiddlewareHan
  const {
  secretKey = clerkEnv.CLERK_SECRET_KEY || '',
  publishableKey = clerkEnv.CLERK_PUBLISHABLE_KEY || '',
+ machineSecretKey = clerkEnv.CLERK_MACHINE_SECRET_KEY || '',
  apiUrl = clerkEnv.CLERK_API_URL,
  apiVersion = clerkEnv.CLERK_API_VERSION,
  frontendApiProxy,
@@ -92,13 +94,15 @@ export const clerkMiddleware = (options?: ClerkMiddlewareOptions): MiddlewareHan
  apiVersion,
  secretKey,
  publishableKey,
+ machineSecretKey,
  userAgent: `${PACKAGE_NAME}@${PACKAGE_VERSION}`,
  });
 
  const requestState = await clerkClient.authenticateRequest(c.req.raw, {
  ...rest,
  secretKey,
  publishableKey,
+ machineSecretKey,
  proxyUrl: derivedProxyUrl,
  acceptsToken: 'any',
  });
@@ -120,7 +124,7 @@ export const clerkMiddleware = (options?: ClerkMiddlewareOptions): MiddlewareHan
  const authObjectFn = ((authOptions?: AuthOptions) =>
  getAuthObjectForAcceptedToken({
  authObject: requestState.toAuth(authOptions) as AuthObject,
- acceptsToken: 'any',
+ acceptsToken: authOptions?.acceptsToken,
  })) as GetAuthFnNoRequest;
 
  c.set('clerkAuth', authObjectFn);

.changeset/fix-hono-getauth-accepts-token.md

@@ -0,0 +1,5 @@
+---
+'@clerk/hono': patch
+---
+
+Add support for `CLERK_MACHINE_SECRET_KEY` environment variable. This enables M2M token scope verification without needing to pass `machineSecretKey` explicitly to `clerkMiddleware()`.

integration/templates/express-vite/src/client/main.ts

@@ -9,6 +9,8 @@ document.addEventListener('DOMContentLoaded', async function () {
  await clerk.load({
  ui: { ClerkUI },
  });
+ // @ts-expect-error: Make waitForSession test utility work
+ window.Clerk = clerk;
 
  if (clerk.isSignedIn) {
  document.getElementById('app')!.innerHTML = `

integration/templates/hono-vite/src/client/main.ts

@@ -9,6 +9,8 @@ document.addEventListener('DOMContentLoaded', async function () {
  await clerk.load({
  ui: { ClerkUI },
  });
+ // @ts-expect-error: Make waitForSession test utility work
+ window.Clerk = clerk;
 
  if (clerk.isSignedIn) {
  document.getElementById('app')!.innerHTML = `

integration/tests/express/machine.test.ts

@@ -0,0 +1,142 @@
+import { test } from '@playwright/test';
+
+import { appConfigs } from '../../presets';
+import type { MachineAuthTestAdapter } from '../../testUtils/machineAuthHelpers';
+import {
+ registerApiKeyAuthTests,
+ registerM2MAuthTests,
+ registerOAuthAuthTests,
+} from '../../testUtils/machineAuthHelpers';
+
+const createMainFile = () => `
+import 'dotenv/config';
+
+import { clerkMiddleware } from '@clerk/express';
+import express from 'express';
+import ViteExpress from 'vite-express';
+import { machineRoutes } from './routes/machine';
+
+const app = express();
+
+app.use(express.json());
+app.use(
+ clerkMiddleware({
+ publishableKey: process.env.VITE_CLERK_PUBLISHABLE_KEY,
+ }),
+);
+
+app.use('/api', machineRoutes);
+
+const port = parseInt(process.env.PORT as string) || 3002;
+ViteExpress.listen(app, port, () => console.log(\`Server is listening on port \${port}...\`));
+`;
+
+const adapter: MachineAuthTestAdapter = {
+ baseConfig: appConfigs.express.vite,
+ apiKey: {
+ path: '/api/me',
+ addRoutes: config =>
+ config
+ .addFile(
+ 'src/server/routes/machine.ts',
+ () => `
+import { getAuth } from '@clerk/express';
+import { Router } from 'express';
+
+const router = Router();
+
+router.get('/me', (req: any, res: any) => {
+ const { userId, tokenType } = getAuth(req, { acceptsToken: 'api_key' });
+
+ if (!userId) {
+ res.status(401).send('Unauthorized');
+ return;
+ }
+
+ res.json({ userId, tokenType });
+});
+
+router.post('/me', (req: any, res: any) => {
+ const authObject = getAuth(req, { acceptsToken: ['api_key', 'session_token'] });
+
+ if (!authObject.isAuthenticated) {
+ res.status(401).send('Unauthorized');
+ return;
+ }
+
+ res.json({ userId: authObject.userId, tokenType: authObject.tokenType });
+});
+
+export const machineRoutes = router;
+ `,
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+ m2m: {
+ path: '/api/m2m',
+ addRoutes: config =>
+ config
+ .addFile(
+ 'src/server/routes/machine.ts',
+ () => `
+import { getAuth } from '@clerk/express';
+import { Router } from 'express';
+
+const router = Router();
+
+router.get('/m2m', (req: any, res: any) => {
+ const { subject, tokenType, machineId } = getAuth(req, { acceptsToken: 'm2m_token' });
+
+ if (!machineId) {
+ res.status(401).send('Unauthorized');
+ return;
+ }
+
+ res.json({ subject, tokenType });
+});
+
+export const machineRoutes = router;
+ `,
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+ oauth: {
+ verifyPath: '/api/oauth-verify',
+ callbackPath: '/api/oauth/callback',
+ addRoutes: config =>
+ config
+ .addFile(
+ 'src/server/routes/machine.ts',
+ () => `
+import { getAuth } from '@clerk/express';
+import { Router } from 'express';
+
+const router = Router();
+
+router.get('/oauth-verify', (req: any, res: any) => {
+ const { userId, tokenType } = getAuth(req, { acceptsToken: 'oauth_token' });
+
+ if (!userId) {
+ res.status(401).send('Unauthorized');
+ return;
+ }
+
+ res.json({ userId, tokenType });
+});
+
+router.get('/oauth/callback', (_req: any, res: any) => {
+ res.json({ message: 'OAuth callback received' });
+});
+
+export const machineRoutes = router;
+ `,
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+};
+
+test.describe('Express machine authentication @machine', () => {
+ registerApiKeyAuthTests(adapter);
+ registerM2MAuthTests(adapter);
+ registerOAuthAuthTests(adapter);
+});

integration/tests/hono/machine.test.ts

@@ -0,0 +1,128 @@
+import { test } from '@playwright/test';
+
+import { appConfigs } from '../../presets';
+import type { MachineAuthTestAdapter } from '../../testUtils/machineAuthHelpers';
+import {
+ registerApiKeyAuthTests,
+ registerM2MAuthTests,
+ registerOAuthAuthTests,
+} from '../../testUtils/machineAuthHelpers';
+
+const createAppFile = (routes: string) => `
+import { clerkMiddleware, getAuth } from '@clerk/hono';
+import { Hono } from 'hono';
+
+const app = new Hono();
+
+app.use(
+ '*',
+ clerkMiddleware({
+ publishableKey: process.env.VITE_CLERK_PUBLISHABLE_KEY,
+ }),
+);
+
+${routes}
+
+export default app;
+`;
+
+const createMainFile = () => `
+import 'dotenv/config';
+
+import { getRequestListener } from '@hono/node-server';
+import express from 'express';
+import ViteExpress from 'vite-express';
+import app from './app';
+
+const expressApp = express();
+const honoRequestListener = getRequestListener(app.fetch);
+
+expressApp.use('/api', async (req: any, res: any) => {
+ await honoRequestListener(req, res);
+});
+
+const port = parseInt(process.env.PORT as string) || 3002;
+ViteExpress.listen(expressApp, port, () => console.log(\`Server is listening on port \${port}...\`));
+`;
+
+const adapter: MachineAuthTestAdapter = {
+ baseConfig: appConfigs.hono.vite,
+ apiKey: {
+ path: '/api/me',
+ addRoutes: config =>
+ config
+ .addFile('src/server/app.ts', () =>
+ createAppFile(`
+app.get('/me', c => {
+ const { userId, tokenType } = getAuth(c, { acceptsToken: 'api_key' });
+
+ if (!userId) {
+ return c.text('Unauthorized', 401);
+ }
+
+ return c.json({ userId, tokenType });
+});
+
+app.post('/me', c => {
+ const authObject = getAuth(c, { acceptsToken: ['api_key', 'session_token'] });
+
+ if (!authObject.isAuthenticated) {
+ return c.text('Unauthorized', 401);
+ }
+
+ return c.json({ userId: authObject.userId, tokenType: authObject.tokenType });
+});
+`),
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+ m2m: {
+ path: '/api/m2m',
+ addRoutes: config =>
+ config
+ .addFile('src/server/app.ts', () =>
+ createAppFile(`
+app.get('/m2m', c => {
+ const { subject, tokenType, machineId } = getAuth(c, { acceptsToken: 'm2m_token' });
+
+ if (!machineId) {
+ return c.text('Unauthorized', 401);
+ }
+
+ return c.json({ subject, tokenType });
+});
+`),
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+ oauth: {
+ verifyPath: '/api/oauth-verify',
+ callbackPath: '/api/oauth/callback',
+ addRoutes: config =>
+ config
+ .addFile('src/server/app.ts', () =>
+ createAppFile(`
+app.get('/oauth-verify', c => {
+ const { userId, tokenType } = getAuth(c, { acceptsToken: 'oauth_token' });
+
+ if (!userId) {
+ return c.text('Unauthorized', 401);
+ }
+
+ return c.json({ userId, tokenType });
+});
+
+app.get('/oauth/callback', c => {
+ return c.json({ message: 'OAuth callback received' });
+});
+`),
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+};
+
+test.describe('Hono machine authentication @machine', () => {
+ registerApiKeyAuthTests(adapter);
+ registerM2MAuthTests(adapter);
+ registerOAuthAuthTests(adapter);
+});

packages/hono/src/clerkMiddleware.ts

@@ -11,6 +11,7 @@ import type { FrontendApiProxyOptions } from './types';
 type ClerkEnv = {
  CLERK_SECRET_KEY: string;
  CLERK_PUBLISHABLE_KEY: string;
+ CLERK_MACHINE_SECRET_KEY?: string;
  CLERK_API_URL?: string;
  CLERK_API_VERSION?: string;
 };
@@ -43,6 +44,7 @@ export const clerkMiddleware = (options?: ClerkMiddlewareOptions): MiddlewareHan
  const {
  secretKey = clerkEnv.CLERK_SECRET_KEY || '',
  publishableKey = clerkEnv.CLERK_PUBLISHABLE_KEY || '',
+ machineSecretKey = clerkEnv.CLERK_MACHINE_SECRET_KEY || '',
  apiUrl = clerkEnv.CLERK_API_URL,
  apiVersion = clerkEnv.CLERK_API_VERSION,
  frontendApiProxy,
@@ -92,13 +94,15 @@ export const clerkMiddleware = (options?: ClerkMiddlewareOptions): MiddlewareHan
  apiVersion,
  secretKey,
  publishableKey,
+ machineSecretKey,
  userAgent: `${PACKAGE_NAME}@${PACKAGE_VERSION}`,
  });
 
  const requestState = await clerkClient.authenticateRequest(c.req.raw, {
  ...rest,
  secretKey,
  publishableKey,
+ machineSecretKey,
  proxyUrl: derivedProxyUrl,
  acceptsToken: 'any',
  });
@@ -120,7 +124,7 @@ export const clerkMiddleware = (options?: ClerkMiddlewareOptions): MiddlewareHan
  const authObjectFn = ((authOptions?: AuthOptions) =>
  getAuthObjectForAcceptedToken({
  authObject: requestState.toAuth(authOptions) as AuthObject,
- acceptsToken: 'any',
+ acceptsToken: authOptions?.acceptsToken,
  })) as GetAuthFnNoRequest;
 
  c.set('clerkAuth', authObjectFn);

.changeset/fix-hono-getauth-accepts-token.md

@@ -0,0 +1,5 @@
+---
+'@clerk/hono': patch
+---
+
+Add support for `CLERK_MACHINE_SECRET_KEY` environment variable. This enables M2M token scope verification without needing to pass `machineSecretKey` explicitly to `clerkMiddleware()`.

integration/templates/express-vite/src/client/main.ts

@@ -9,6 +9,8 @@ document.addEventListener('DOMContentLoaded', async function () {
  await clerk.load({
  ui: { ClerkUI },
  });
+ // @ts-expect-error: Make waitForSession test utility work
+ window.Clerk = clerk;
 
  if (clerk.isSignedIn) {
  document.getElementById('app')!.innerHTML = `

integration/templates/hono-vite/src/client/main.ts

@@ -9,6 +9,8 @@ document.addEventListener('DOMContentLoaded', async function () {
  await clerk.load({
  ui: { ClerkUI },
  });
+ // @ts-expect-error: Make waitForSession test utility work
+ window.Clerk = clerk;
 
  if (clerk.isSignedIn) {
  document.getElementById('app')!.innerHTML = `

integration/tests/express/machine.test.ts

@@ -0,0 +1,142 @@
+import { test } from '@playwright/test';
+
+import { appConfigs } from '../../presets';
+import type { MachineAuthTestAdapter } from '../../testUtils/machineAuthHelpers';
+import {
+ registerApiKeyAuthTests,
+ registerM2MAuthTests,
+ registerOAuthAuthTests,
+} from '../../testUtils/machineAuthHelpers';
+
+const createMainFile = () => `
+import 'dotenv/config';
+
+import { clerkMiddleware } from '@clerk/express';
+import express from 'express';
+import ViteExpress from 'vite-express';
+import { machineRoutes } from './routes/machine';
+
+const app = express();
+
+app.use(express.json());
+app.use(
+ clerkMiddleware({
+ publishableKey: process.env.VITE_CLERK_PUBLISHABLE_KEY,
+ }),
+);
+
+app.use('/api', machineRoutes);
+
+const port = parseInt(process.env.PORT as string) || 3002;
+ViteExpress.listen(app, port, () => console.log(\`Server is listening on port \${port}...\`));
+`;
+
+const adapter: MachineAuthTestAdapter = {
+ baseConfig: appConfigs.express.vite,
+ apiKey: {
+ path: '/api/me',
+ addRoutes: config =>
+ config
+ .addFile(
+ 'src/server/routes/machine.ts',
+ () => `
+import { getAuth } from '@clerk/express';
+import { Router } from 'express';
+
+const router = Router();
+
+router.get('/me', (req: any, res: any) => {
+ const { userId, tokenType } = getAuth(req, { acceptsToken: 'api_key' });
+
+ if (!userId) {
+ res.status(401).send('Unauthorized');
+ return;
+ }
+
+ res.json({ userId, tokenType });
+});
+
+router.post('/me', (req: any, res: any) => {
+ const authObject = getAuth(req, { acceptsToken: ['api_key', 'session_token'] });
+
+ if (!authObject.isAuthenticated) {
+ res.status(401).send('Unauthorized');
+ return;
+ }
+
+ res.json({ userId: authObject.userId, tokenType: authObject.tokenType });
+});
+
+export const machineRoutes = router;
+ `,
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+ m2m: {
+ path: '/api/m2m',
+ addRoutes: config =>
+ config
+ .addFile(
+ 'src/server/routes/machine.ts',
+ () => `
+import { getAuth } from '@clerk/express';
+import { Router } from 'express';
+
+const router = Router();
+
+router.get('/m2m', (req: any, res: any) => {
+ const { subject, tokenType, machineId } = getAuth(req, { acceptsToken: 'm2m_token' });
+
+ if (!machineId) {
+ res.status(401).send('Unauthorized');
+ return;
+ }
+
+ res.json({ subject, tokenType });
+});
+
+export const machineRoutes = router;
+ `,
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+ oauth: {
+ verifyPath: '/api/oauth-verify',
+ callbackPath: '/api/oauth/callback',
+ addRoutes: config =>
+ config
+ .addFile(
+ 'src/server/routes/machine.ts',
+ () => `
+import { getAuth } from '@clerk/express';
+import { Router } from 'express';
+
+const router = Router();
+
+router.get('/oauth-verify', (req: any, res: any) => {
+ const { userId, tokenType } = getAuth(req, { acceptsToken: 'oauth_token' });
+
+ if (!userId) {
+ res.status(401).send('Unauthorized');
+ return;
+ }
+
+ res.json({ userId, tokenType });
+});
+
+router.get('/oauth/callback', (_req: any, res: any) => {
+ res.json({ message: 'OAuth callback received' });
+});
+
+export const machineRoutes = router;
+ `,
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+};
+
+test.describe('Express machine authentication @machine', () => {
+ registerApiKeyAuthTests(adapter);
+ registerM2MAuthTests(adapter);
+ registerOAuthAuthTests(adapter);
+});

integration/tests/hono/machine.test.ts

@@ -0,0 +1,128 @@
+import { test } from '@playwright/test';
+
+import { appConfigs } from '../../presets';
+import type { MachineAuthTestAdapter } from '../../testUtils/machineAuthHelpers';
+import {
+ registerApiKeyAuthTests,
+ registerM2MAuthTests,
+ registerOAuthAuthTests,
+} from '../../testUtils/machineAuthHelpers';
+
+const createAppFile = (routes: string) => `
+import { clerkMiddleware, getAuth } from '@clerk/hono';
+import { Hono } from 'hono';
+
+const app = new Hono();
+
+app.use(
+ '*',
+ clerkMiddleware({
+ publishableKey: process.env.VITE_CLERK_PUBLISHABLE_KEY,
+ }),
+);
+
+${routes}
+
+export default app;
+`;
+
+const createMainFile = () => `
+import 'dotenv/config';
+
+import { getRequestListener } from '@hono/node-server';
+import express from 'express';
+import ViteExpress from 'vite-express';
+import app from './app';
+
+const expressApp = express();
+const honoRequestListener = getRequestListener(app.fetch);
+
+expressApp.use('/api', async (req: any, res: any) => {
+ await honoRequestListener(req, res);
+});
+
+const port = parseInt(process.env.PORT as string) || 3002;
+ViteExpress.listen(expressApp, port, () => console.log(\`Server is listening on port \${port}...\`));
+`;
+
+const adapter: MachineAuthTestAdapter = {
+ baseConfig: appConfigs.hono.vite,
+ apiKey: {
+ path: '/api/me',
+ addRoutes: config =>
+ config
+ .addFile('src/server/app.ts', () =>
+ createAppFile(`
+app.get('/me', c => {
+ const { userId, tokenType } = getAuth(c, { acceptsToken: 'api_key' });
+
+ if (!userId) {
+ return c.text('Unauthorized', 401);
+ }
+
+ return c.json({ userId, tokenType });
+});
+
+app.post('/me', c => {
+ const authObject = getAuth(c, { acceptsToken: ['api_key', 'session_token'] });
+
+ if (!authObject.isAuthenticated) {
+ return c.text('Unauthorized', 401);
+ }
+
+ return c.json({ userId: authObject.userId, tokenType: authObject.tokenType });
+});
+`),
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+ m2m: {
+ path: '/api/m2m',
+ addRoutes: config =>
+ config
+ .addFile('src/server/app.ts', () =>
+ createAppFile(`
+app.get('/m2m', c => {
+ const { subject, tokenType, machineId } = getAuth(c, { acceptsToken: 'm2m_token' });
+
+ if (!machineId) {
+ return c.text('Unauthorized', 401);
+ }
+
+ return c.json({ subject, tokenType });
+});
+`),
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+ oauth: {
+ verifyPath: '/api/oauth-verify',
+ callbackPath: '/api/oauth/callback',
+ addRoutes: config =>
+ config
+ .addFile('src/server/app.ts', () =>
+ createAppFile(`
+app.get('/oauth-verify', c => {
+ const { userId, tokenType } = getAuth(c, { acceptsToken: 'oauth_token' });
+
+ if (!userId) {
+ return c.text('Unauthorized', 401);
+ }
+
+ return c.json({ userId, tokenType });
+});
+
+app.get('/oauth/callback', c => {
+ return c.json({ message: 'OAuth callback received' });
+});
+`),
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+};
+
+test.describe('Hono machine authentication @machine', () => {
+ registerApiKeyAuthTests(adapter);
+ registerM2MAuthTests(adapter);
+ registerOAuthAuthTests(adapter);
+});

packages/hono/src/clerkMiddleware.ts

@@ -11,6 +11,7 @@ import type { FrontendApiProxyOptions } from './types';
 type ClerkEnv = {
  CLERK_SECRET_KEY: string;
  CLERK_PUBLISHABLE_KEY: string;
+ CLERK_MACHINE_SECRET_KEY?: string;
  CLERK_API_URL?: string;
  CLERK_API_VERSION?: string;
 };
@@ -43,6 +44,7 @@ export const clerkMiddleware = (options?: ClerkMiddlewareOptions): MiddlewareHan
  const {
  secretKey = clerkEnv.CLERK_SECRET_KEY || '',
  publishableKey = clerkEnv.CLERK_PUBLISHABLE_KEY || '',
+ machineSecretKey = clerkEnv.CLERK_MACHINE_SECRET_KEY || '',
  apiUrl = clerkEnv.CLERK_API_URL,
  apiVersion = clerkEnv.CLERK_API_VERSION,
  frontendApiProxy,
@@ -92,13 +94,15 @@ export const clerkMiddleware = (options?: ClerkMiddlewareOptions): MiddlewareHan
  apiVersion,
  secretKey,
  publishableKey,
+ machineSecretKey,
  userAgent: `${PACKAGE_NAME}@${PACKAGE_VERSION}`,
  });
 
  const requestState = await clerkClient.authenticateRequest(c.req.raw, {
  ...rest,
  secretKey,
  publishableKey,
+ machineSecretKey,
  proxyUrl: derivedProxyUrl,
  acceptsToken: 'any',
  });
@@ -120,7 +124,7 @@ export const clerkMiddleware = (options?: ClerkMiddlewareOptions): MiddlewareHan
  const authObjectFn = ((authOptions?: AuthOptions) =>
  getAuthObjectForAcceptedToken({
  authObject: requestState.toAuth(authOptions) as AuthObject,
- acceptsToken: 'any',
+ acceptsToken: authOptions?.acceptsToken,
  })) as GetAuthFnNoRequest;
 
  c.set('clerkAuth', authObjectFn);

.changeset/fix-hono-getauth-accepts-token.md

@@ -0,0 +1,5 @@
+---
+'@clerk/hono': patch
+---
+
+Add support for `CLERK_MACHINE_SECRET_KEY` environment variable. This enables M2M token scope verification without needing to pass `machineSecretKey` explicitly to `clerkMiddleware()`.

integration/templates/express-vite/src/client/main.ts

@@ -9,6 +9,8 @@ document.addEventListener('DOMContentLoaded', async function () {
  await clerk.load({
  ui: { ClerkUI },
  });
+ // @ts-expect-error: Make waitForSession test utility work
+ window.Clerk = clerk;
 
  if (clerk.isSignedIn) {
  document.getElementById('app')!.innerHTML = `

integration/templates/hono-vite/src/client/main.ts

@@ -9,6 +9,8 @@ document.addEventListener('DOMContentLoaded', async function () {
  await clerk.load({
  ui: { ClerkUI },
  });
+ // @ts-expect-error: Make waitForSession test utility work
+ window.Clerk = clerk;
 
  if (clerk.isSignedIn) {
  document.getElementById('app')!.innerHTML = `

integration/tests/express/machine.test.ts

@@ -0,0 +1,142 @@
+import { test } from '@playwright/test';
+
+import { appConfigs } from '../../presets';
+import type { MachineAuthTestAdapter } from '../../testUtils/machineAuthHelpers';
+import {
+ registerApiKeyAuthTests,
+ registerM2MAuthTests,
+ registerOAuthAuthTests,
+} from '../../testUtils/machineAuthHelpers';
+
+const createMainFile = () => `
+import 'dotenv/config';
+
+import { clerkMiddleware } from '@clerk/express';
+import express from 'express';
+import ViteExpress from 'vite-express';
+import { machineRoutes } from './routes/machine';
+
+const app = express();
+
+app.use(express.json());
+app.use(
+ clerkMiddleware({
+ publishableKey: process.env.VITE_CLERK_PUBLISHABLE_KEY,
+ }),
+);
+
+app.use('/api', machineRoutes);
+
+const port = parseInt(process.env.PORT as string) || 3002;
+ViteExpress.listen(app, port, () => console.log(\`Server is listening on port \${port}...\`));
+`;
+
+const adapter: MachineAuthTestAdapter = {
+ baseConfig: appConfigs.express.vite,
+ apiKey: {
+ path: '/api/me',
+ addRoutes: config =>
+ config
+ .addFile(
+ 'src/server/routes/machine.ts',
+ () => `
+import { getAuth } from '@clerk/express';
+import { Router } from 'express';
+
+const router = Router();
+
+router.get('/me', (req: any, res: any) => {
+ const { userId, tokenType } = getAuth(req, { acceptsToken: 'api_key' });
+
+ if (!userId) {
+ res.status(401).send('Unauthorized');
+ return;
+ }
+
+ res.json({ userId, tokenType });
+});
+
+router.post('/me', (req: any, res: any) => {
+ const authObject = getAuth(req, { acceptsToken: ['api_key', 'session_token'] });
+
+ if (!authObject.isAuthenticated) {
+ res.status(401).send('Unauthorized');
+ return;
+ }
+
+ res.json({ userId: authObject.userId, tokenType: authObject.tokenType });
+});
+
+export const machineRoutes = router;
+ `,
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+ m2m: {
+ path: '/api/m2m',
+ addRoutes: config =>
+ config
+ .addFile(
+ 'src/server/routes/machine.ts',
+ () => `
+import { getAuth } from '@clerk/express';
+import { Router } from 'express';
+
+const router = Router();
+
+router.get('/m2m', (req: any, res: any) => {
+ const { subject, tokenType, machineId } = getAuth(req, { acceptsToken: 'm2m_token' });
+
+ if (!machineId) {
+ res.status(401).send('Unauthorized');
+ return;
+ }
+
+ res.json({ subject, tokenType });
+});
+
+export const machineRoutes = router;
+ `,
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+ oauth: {
+ verifyPath: '/api/oauth-verify',
+ callbackPath: '/api/oauth/callback',
+ addRoutes: config =>
+ config
+ .addFile(
+ 'src/server/routes/machine.ts',
+ () => `
+import { getAuth } from '@clerk/express';
+import { Router } from 'express';
+
+const router = Router();
+
+router.get('/oauth-verify', (req: any, res: any) => {
+ const { userId, tokenType } = getAuth(req, { acceptsToken: 'oauth_token' });
+
+ if (!userId) {
+ res.status(401).send('Unauthorized');
+ return;
+ }
+
+ res.json({ userId, tokenType });
+});
+
+router.get('/oauth/callback', (_req: any, res: any) => {
+ res.json({ message: 'OAuth callback received' });
+});
+
+export const machineRoutes = router;
+ `,
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+};
+
+test.describe('Express machine authentication @machine', () => {
+ registerApiKeyAuthTests(adapter);
+ registerM2MAuthTests(adapter);
+ registerOAuthAuthTests(adapter);
+});

integration/tests/hono/machine.test.ts

@@ -0,0 +1,128 @@
+import { test } from '@playwright/test';
+
+import { appConfigs } from '../../presets';
+import type { MachineAuthTestAdapter } from '../../testUtils/machineAuthHelpers';
+import {
+ registerApiKeyAuthTests,
+ registerM2MAuthTests,
+ registerOAuthAuthTests,
+} from '../../testUtils/machineAuthHelpers';
+
+const createAppFile = (routes: string) => `
+import { clerkMiddleware, getAuth } from '@clerk/hono';
+import { Hono } from 'hono';
+
+const app = new Hono();
+
+app.use(
+ '*',
+ clerkMiddleware({
+ publishableKey: process.env.VITE_CLERK_PUBLISHABLE_KEY,
+ }),
+);
+
+${routes}
+
+export default app;
+`;
+
+const createMainFile = () => `
+import 'dotenv/config';
+
+import { getRequestListener } from '@hono/node-server';
+import express from 'express';
+import ViteExpress from 'vite-express';
+import app from './app';
+
+const expressApp = express();
+const honoRequestListener = getRequestListener(app.fetch);
+
+expressApp.use('/api', async (req: any, res: any) => {
+ await honoRequestListener(req, res);
+});
+
+const port = parseInt(process.env.PORT as string) || 3002;
+ViteExpress.listen(expressApp, port, () => console.log(\`Server is listening on port \${port}...\`));
+`;
+
+const adapter: MachineAuthTestAdapter = {
+ baseConfig: appConfigs.hono.vite,
+ apiKey: {
+ path: '/api/me',
+ addRoutes: config =>
+ config
+ .addFile('src/server/app.ts', () =>
+ createAppFile(`
+app.get('/me', c => {
+ const { userId, tokenType } = getAuth(c, { acceptsToken: 'api_key' });
+
+ if (!userId) {
+ return c.text('Unauthorized', 401);
+ }
+
+ return c.json({ userId, tokenType });
+});
+
+app.post('/me', c => {
+ const authObject = getAuth(c, { acceptsToken: ['api_key', 'session_token'] });
+
+ if (!authObject.isAuthenticated) {
+ return c.text('Unauthorized', 401);
+ }
+
+ return c.json({ userId: authObject.userId, tokenType: authObject.tokenType });
+});
+`),
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+ m2m: {
+ path: '/api/m2m',
+ addRoutes: config =>
+ config
+ .addFile('src/server/app.ts', () =>
+ createAppFile(`
+app.get('/m2m', c => {
+ const { subject, tokenType, machineId } = getAuth(c, { acceptsToken: 'm2m_token' });
+
+ if (!machineId) {
+ return c.text('Unauthorized', 401);
+ }
+
+ return c.json({ subject, tokenType });
+});
+`),
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+ oauth: {
+ verifyPath: '/api/oauth-verify',
+ callbackPath: '/api/oauth/callback',
+ addRoutes: config =>
+ config
+ .addFile('src/server/app.ts', () =>
+ createAppFile(`
+app.get('/oauth-verify', c => {
+ const { userId, tokenType } = getAuth(c, { acceptsToken: 'oauth_token' });
+
+ if (!userId) {
+ return c.text('Unauthorized', 401);
+ }
+
+ return c.json({ userId, tokenType });
+});
+
+app.get('/oauth/callback', c => {
+ return c.json({ message: 'OAuth callback received' });
+});
+`),
+ )
+ .addFile('src/server/main.ts', () => createMainFile()),
+ },
+};
+
+test.describe('Hono machine authentication @machine', () => {
+ registerApiKeyAuthTests(adapter);
+ registerM2MAuthTests(adapter);
+ registerOAuthAuthTests(adapter);
+});

packages/hono/src/clerkMiddleware.ts

@@ -11,6 +11,7 @@ import type { FrontendApiProxyOptions } from './types';
 type ClerkEnv = {
  CLERK_SECRET_KEY: string;
  CLERK_PUBLISHABLE_KEY: string;
+ CLERK_MACHINE_SECRET_KEY?: string;
  CLERK_API_URL?: string;
  CLERK_API_VERSION?: string;
 };
@@ -43,6 +44,7 @@ export const clerkMiddleware = (options?: ClerkMiddlewareOptions): MiddlewareHan
  const {
  secretKey = clerkEnv.CLERK_SECRET_KEY || '',
  publishableKey = clerkEnv.CLERK_PUBLISHABLE_KEY || '',
+ machineSecretKey = clerkEnv.CLERK_MACHINE_SECRET_KEY || '',
  apiUrl = clerkEnv.CLERK_API_URL,
  apiVersion = clerkEnv.CLERK_API_VERSION,
  frontendApiProxy,
@@ -92,13 +94,15 @@ export const clerkMiddleware = (options?: ClerkMiddlewareOptions): MiddlewareHan
  apiVersion,
  secretKey,
  publishableKey,
+ machineSecretKey,
  userAgent: `${PACKAGE_NAME}@${PACKAGE_VERSION}`,
  });
 
  const requestState = await clerkClient.authenticateRequest(c.req.raw, {
  ...rest,
  secretKey,
  publishableKey,
+ machineSecretKey,
  proxyUrl: derivedProxyUrl,
  acceptsToken: 'any',
  });
@@ -120,7 +124,7 @@ export const clerkMiddleware = (options?: ClerkMiddlewareOptions): MiddlewareHan
  const authObjectFn = ((authOptions?: AuthOptions) =>
  getAuthObjectForAcceptedToken({
  authObject: requestState.toAuth(authOptions) as AuthObject,
- acceptsToken: 'any',
+ acceptsToken: authOptions?.acceptsToken,
  })) as GetAuthFnNoRequest;
 
  c.set('clerkAuth', authObjectFn);