chore(express,react,shared): Support dynamic options callback in clerkMiddleware by wobsoriano · Pull Request #8398 · clerk/javascript

wobsoriano · 2026-04-24T13:27:32Z

Description

app.use(clerkMiddleware((req)=>({publishableKey: req.hostname==='domain-a.com' ? PK_A : PK_B,})));

Checklist

pnpm test runs as expected.
pnpm build runs as expected.
(If applicable) JSDoc comments have been added or updated for any package exports
(If applicable) Documentation has been updated

Type of change

Add ClerkMiddlewareOptionsCallback type so multi-domain/multi-tenant apps can resolve publishableKey and secretKey per request: app.use(clerkMiddleware((req) => ({ publishableKey: req.hostname === 'a.com' ? PK_A : PK_B, secretKey: req.hostname === 'a.com' ? SK_A : SK_B, }))); Static options path is unchanged. Callback path awaits the function result and creates the auth handler per request.

vercel · 2026-04-24T13:27:37Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Skipped		Apr 24, 2026 9:47pm

changeset-bot · 2026-04-24T13:27:38Z

🦋 Changeset detected

Latest commit: f48bd81

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 20 packages

Name	Type
@clerk/shared	Patch
@clerk/react	Patch
@clerk/express	Patch
@clerk/astro	Patch
@clerk/backend	Patch
@clerk/chrome-extension	Patch
@clerk/clerk-js	Patch
@clerk/expo-passkeys	Patch
@clerk/expo	Patch
@clerk/fastify	Patch
@clerk/hono	Patch
@clerk/localizations	Patch
@clerk/msw	Patch
@clerk/nextjs	Patch
@clerk/nuxt	Patch
@clerk/react-router	Patch
@clerk/tanstack-react-start	Patch
@clerk/testing	Patch
@clerk/ui	Patch
@clerk/vue	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

coderabbitai · 2026-04-24T14:29:39Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

📝 Walkthrough

Walkthrough

This PR enhances the Express middleware to support dynamic, request-based configuration through a callback pattern while introducing a cross-package utility for multi-domain setups. The clerkMiddleware function now accepts either static options or an async-capable callback that derives options from the incoming request. A new publishableKeyFromHost utility is added to the shared package and re-exported through internal entry points in both React and Express packages. Build configuration is extended to support the new internal export path, and comprehensive tests validate the callback behavior including Promise handling and request properties.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: adding support for dynamic options callback in clerkMiddleware across express, react, and shared packages.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The pull request description provides a clear example of the new feature: a callback function passed to clerkMiddleware that dynamically selects configuration based on request hostname.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

pkg-pr-new · 2026-04-24T14:32:02Z

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8398

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8398

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8398

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8398

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@8398

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8398

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8398

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8398

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8398

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8398

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8398

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8398

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8398

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8398

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8398

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8398

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8398

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8398

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8398

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8398

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8398

commit: f48bd81

Derives a production publishable key from the current request hostname, falling back to the configured key for development instances (pk_test_). Built on the existing buildPublishableKey and isDevelopmentFromPublishableKey helpers. Re-exported from @clerk/react/internal so Replit and other multi-domain apps can use it without additional dependencies: import { publishableKeyFromHost } from '@clerk/react/internal' // React <ClerkProvider publishableKey={publishableKeyFromHost(window.location.host, process.env.VITE_CLERK_PUBLISHABLE_KEY)}> // Express (with the new clerkMiddleware callback) clerkMiddleware((req) => ({ publishableKey: publishableKeyFromHost(req.hostname, process.env.CLERK_PUBLISHABLE_KEY), }))

Add @clerk/express/internal re-exporting publishableKeyFromHost from @clerk/shared/keys. Mirrors the @clerk/react/internal pattern. Also simplifies publishableKeyFromHost to take only host — buildPublishableKey already handles dev vs prod detection via FAPI host patterns, so no fallback key parameter is needed. Usage: import { publishableKeyFromHost } from '@clerk/express/internal' clerkMiddleware((req) => ({ publishableKey: publishableKeyFromHost(req.hostname), }))

Without it, dev instances on localhost produce an incorrect pk_live_ key. If fallbackKey is a pk_test_ key it is returned as-is; otherwise the key is derived from the host for production multi-domain setups.

wobsoriano · 2026-04-24T20:01:11Z

+ if (fallbackKey && isDevelopmentFromPublishableKey(fallbackKey)) {
+ return fallbackKey;
+ }
+ return buildPublishableKey(`clerk.${host.toLowerCase()}`);


existing helper that converts a FAPI URL into a base64-encoded publishable key
https://github.com/clerk/javascript/blob/70bd92ba85539aefb880f33e5fcd8cc1f1199756/packages/shared/src/keys.ts#L38,L44

jacekradko · 2026-04-24T20:16:57Z

@@ -0,0 +1 @@
+export { publishableKeyFromHost } from '@clerk/shared/keys';


🤔 I am a little hesitant to add a whole new entrypoint to a package in a hotfix.. just seems a bit early for this

are you saying we should just export from @clerk/express or let them import as-is from @clerk/shared/keys?

For now I think I would suggest they import from @clerk/shared/keys until we are sure this is something we want to re-export from an SDK package.

…e docstring example

…lishableKeyFromHost

…s example

…mple

wobsoriano · 2026-04-24T13:27:32Z

Description

app.use(clerkMiddleware((req)=>({publishableKey: req.hostname==='domain-a.com' ? PK_A : PK_B,})));

Checklist

pnpm test runs as expected.
pnpm build runs as expected.
(If applicable) JSDoc comments have been added or updated for any package exports
(If applicable) Documentation has been updated

Type of change

Add ClerkMiddlewareOptionsCallback type so multi-domain/multi-tenant apps can resolve publishableKey and secretKey per request: app.use(clerkMiddleware((req) => ({ publishableKey: req.hostname === 'a.com' ? PK_A : PK_B, secretKey: req.hostname === 'a.com' ? SK_A : SK_B, }))); Static options path is unchanged. Callback path awaits the function result and creates the auth handler per request.

vercel · 2026-04-24T13:27:37Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Skipped		Apr 24, 2026 9:47pm

changeset-bot · 2026-04-24T13:27:38Z

🦋 Changeset detected

Latest commit: f48bd81

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 20 packages

Name	Type
@clerk/shared	Patch
@clerk/react	Patch
@clerk/express	Patch
@clerk/astro	Patch
@clerk/backend	Patch
@clerk/chrome-extension	Patch
@clerk/clerk-js	Patch
@clerk/expo-passkeys	Patch
@clerk/expo	Patch
@clerk/fastify	Patch
@clerk/hono	Patch
@clerk/localizations	Patch
@clerk/msw	Patch
@clerk/nextjs	Patch
@clerk/nuxt	Patch
@clerk/react-router	Patch
@clerk/tanstack-react-start	Patch
@clerk/testing	Patch
@clerk/ui	Patch
@clerk/vue	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

coderabbitai · 2026-04-24T14:29:39Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

📝 Walkthrough

Walkthrough

This PR enhances the Express middleware to support dynamic, request-based configuration through a callback pattern while introducing a cross-package utility for multi-domain setups. The clerkMiddleware function now accepts either static options or an async-capable callback that derives options from the incoming request. A new publishableKeyFromHost utility is added to the shared package and re-exported through internal entry points in both React and Express packages. Build configuration is extended to support the new internal export path, and comprehensive tests validate the callback behavior including Promise handling and request properties.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: adding support for dynamic options callback in clerkMiddleware across express, react, and shared packages.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The pull request description provides a clear example of the new feature: a callback function passed to clerkMiddleware that dynamically selects configuration based on request hostname.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

pkg-pr-new · 2026-04-24T14:32:02Z

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8398

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8398

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8398

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8398

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@8398

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8398

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8398

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8398

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8398

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8398

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8398

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8398

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8398

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8398

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8398

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8398

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8398

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8398

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8398

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8398

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8398

commit: f48bd81

Derives a production publishable key from the current request hostname, falling back to the configured key for development instances (pk_test_). Built on the existing buildPublishableKey and isDevelopmentFromPublishableKey helpers. Re-exported from @clerk/react/internal so Replit and other multi-domain apps can use it without additional dependencies: import { publishableKeyFromHost } from '@clerk/react/internal' // React <ClerkProvider publishableKey={publishableKeyFromHost(window.location.host, process.env.VITE_CLERK_PUBLISHABLE_KEY)}> // Express (with the new clerkMiddleware callback) clerkMiddleware((req) => ({ publishableKey: publishableKeyFromHost(req.hostname, process.env.CLERK_PUBLISHABLE_KEY), }))

Add @clerk/express/internal re-exporting publishableKeyFromHost from @clerk/shared/keys. Mirrors the @clerk/react/internal pattern. Also simplifies publishableKeyFromHost to take only host — buildPublishableKey already handles dev vs prod detection via FAPI host patterns, so no fallback key parameter is needed. Usage: import { publishableKeyFromHost } from '@clerk/express/internal' clerkMiddleware((req) => ({ publishableKey: publishableKeyFromHost(req.hostname), }))

Without it, dev instances on localhost produce an incorrect pk_live_ key. If fallbackKey is a pk_test_ key it is returned as-is; otherwise the key is derived from the host for production multi-domain setups.

wobsoriano · 2026-04-24T20:01:11Z

+ if (fallbackKey && isDevelopmentFromPublishableKey(fallbackKey)) {
+ return fallbackKey;
+ }
+ return buildPublishableKey(`clerk.${host.toLowerCase()}`);


existing helper that converts a FAPI URL into a base64-encoded publishable key
https://github.com/clerk/javascript/blob/70bd92ba85539aefb880f33e5fcd8cc1f1199756/packages/shared/src/keys.ts#L38,L44

jacekradko · 2026-04-24T20:16:57Z

@@ -0,0 +1 @@
+export { publishableKeyFromHost } from '@clerk/shared/keys';


🤔 I am a little hesitant to add a whole new entrypoint to a package in a hotfix.. just seems a bit early for this

are you saying we should just export from @clerk/express or let them import as-is from @clerk/shared/keys?

For now I think I would suggest they import from @clerk/shared/keys until we are sure this is something we want to re-export from an SDK package.

…e docstring example

…lishableKeyFromHost

…s example

…mple

wobsoriano · 2026-04-24T13:27:32Z

Description

app.use(clerkMiddleware((req)=>({publishableKey: req.hostname==='domain-a.com' ? PK_A : PK_B,})));

Checklist

pnpm test runs as expected.
pnpm build runs as expected.
(If applicable) JSDoc comments have been added or updated for any package exports
(If applicable) Documentation has been updated

Type of change

Add ClerkMiddlewareOptionsCallback type so multi-domain/multi-tenant apps can resolve publishableKey and secretKey per request: app.use(clerkMiddleware((req) => ({ publishableKey: req.hostname === 'a.com' ? PK_A : PK_B, secretKey: req.hostname === 'a.com' ? SK_A : SK_B, }))); Static options path is unchanged. Callback path awaits the function result and creates the auth handler per request.

vercel · 2026-04-24T13:27:37Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Skipped		Apr 24, 2026 9:47pm

changeset-bot · 2026-04-24T13:27:38Z

🦋 Changeset detected

Latest commit: f48bd81

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 20 packages

Name	Type
@clerk/shared	Patch
@clerk/react	Patch
@clerk/express	Patch
@clerk/astro	Patch
@clerk/backend	Patch
@clerk/chrome-extension	Patch
@clerk/clerk-js	Patch
@clerk/expo-passkeys	Patch
@clerk/expo	Patch
@clerk/fastify	Patch
@clerk/hono	Patch
@clerk/localizations	Patch
@clerk/msw	Patch
@clerk/nextjs	Patch
@clerk/nuxt	Patch
@clerk/react-router	Patch
@clerk/tanstack-react-start	Patch
@clerk/testing	Patch
@clerk/ui	Patch
@clerk/vue	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

coderabbitai · 2026-04-24T14:29:39Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

📝 Walkthrough

Walkthrough

This PR enhances the Express middleware to support dynamic, request-based configuration through a callback pattern while introducing a cross-package utility for multi-domain setups. The clerkMiddleware function now accepts either static options or an async-capable callback that derives options from the incoming request. A new publishableKeyFromHost utility is added to the shared package and re-exported through internal entry points in both React and Express packages. Build configuration is extended to support the new internal export path, and comprehensive tests validate the callback behavior including Promise handling and request properties.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: adding support for dynamic options callback in clerkMiddleware across express, react, and shared packages.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The pull request description provides a clear example of the new feature: a callback function passed to clerkMiddleware that dynamically selects configuration based on request hostname.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

pkg-pr-new · 2026-04-24T14:32:02Z

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8398

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8398

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8398

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8398

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@8398

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8398

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8398

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8398

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8398

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8398

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8398

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8398

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8398

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8398

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8398

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8398

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8398

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8398

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8398

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8398

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8398

commit: f48bd81

Derives a production publishable key from the current request hostname, falling back to the configured key for development instances (pk_test_). Built on the existing buildPublishableKey and isDevelopmentFromPublishableKey helpers. Re-exported from @clerk/react/internal so Replit and other multi-domain apps can use it without additional dependencies: import { publishableKeyFromHost } from '@clerk/react/internal' // React <ClerkProvider publishableKey={publishableKeyFromHost(window.location.host, process.env.VITE_CLERK_PUBLISHABLE_KEY)}> // Express (with the new clerkMiddleware callback) clerkMiddleware((req) => ({ publishableKey: publishableKeyFromHost(req.hostname, process.env.CLERK_PUBLISHABLE_KEY), }))

Add @clerk/express/internal re-exporting publishableKeyFromHost from @clerk/shared/keys. Mirrors the @clerk/react/internal pattern. Also simplifies publishableKeyFromHost to take only host — buildPublishableKey already handles dev vs prod detection via FAPI host patterns, so no fallback key parameter is needed. Usage: import { publishableKeyFromHost } from '@clerk/express/internal' clerkMiddleware((req) => ({ publishableKey: publishableKeyFromHost(req.hostname), }))

Without it, dev instances on localhost produce an incorrect pk_live_ key. If fallbackKey is a pk_test_ key it is returned as-is; otherwise the key is derived from the host for production multi-domain setups.

wobsoriano · 2026-04-24T20:01:11Z

+ if (fallbackKey && isDevelopmentFromPublishableKey(fallbackKey)) {
+ return fallbackKey;
+ }
+ return buildPublishableKey(`clerk.${host.toLowerCase()}`);


existing helper that converts a FAPI URL into a base64-encoded publishable key
https://github.com/clerk/javascript/blob/70bd92ba85539aefb880f33e5fcd8cc1f1199756/packages/shared/src/keys.ts#L38,L44

jacekradko · 2026-04-24T20:16:57Z

@@ -0,0 +1 @@
+export { publishableKeyFromHost } from '@clerk/shared/keys';


🤔 I am a little hesitant to add a whole new entrypoint to a package in a hotfix.. just seems a bit early for this

are you saying we should just export from @clerk/express or let them import as-is from @clerk/shared/keys?

For now I think I would suggest they import from @clerk/shared/keys until we are sure this is something we want to re-export from an SDK package.

…e docstring example

…lishableKeyFromHost

…s example

…mple

wobsoriano · 2026-04-24T13:27:32Z

Description

app.use(clerkMiddleware((req)=>({publishableKey: req.hostname==='domain-a.com' ? PK_A : PK_B,})));

Checklist

pnpm test runs as expected.
pnpm build runs as expected.
(If applicable) JSDoc comments have been added or updated for any package exports
(If applicable) Documentation has been updated

Type of change

Add ClerkMiddlewareOptionsCallback type so multi-domain/multi-tenant apps can resolve publishableKey and secretKey per request: app.use(clerkMiddleware((req) => ({ publishableKey: req.hostname === 'a.com' ? PK_A : PK_B, secretKey: req.hostname === 'a.com' ? SK_A : SK_B, }))); Static options path is unchanged. Callback path awaits the function result and creates the auth handler per request.

vercel · 2026-04-24T13:27:37Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Skipped		Apr 24, 2026 9:47pm

changeset-bot · 2026-04-24T13:27:38Z

🦋 Changeset detected

Latest commit: f48bd81

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 20 packages

Name	Type
@clerk/shared	Patch
@clerk/react	Patch
@clerk/express	Patch
@clerk/astro	Patch
@clerk/backend	Patch
@clerk/chrome-extension	Patch
@clerk/clerk-js	Patch
@clerk/expo-passkeys	Patch
@clerk/expo	Patch
@clerk/fastify	Patch
@clerk/hono	Patch
@clerk/localizations	Patch
@clerk/msw	Patch
@clerk/nextjs	Patch
@clerk/nuxt	Patch
@clerk/react-router	Patch
@clerk/tanstack-react-start	Patch
@clerk/testing	Patch
@clerk/ui	Patch
@clerk/vue	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

coderabbitai · 2026-04-24T14:29:39Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

📝 Walkthrough

Walkthrough

This PR enhances the Express middleware to support dynamic, request-based configuration through a callback pattern while introducing a cross-package utility for multi-domain setups. The clerkMiddleware function now accepts either static options or an async-capable callback that derives options from the incoming request. A new publishableKeyFromHost utility is added to the shared package and re-exported through internal entry points in both React and Express packages. Build configuration is extended to support the new internal export path, and comprehensive tests validate the callback behavior including Promise handling and request properties.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: adding support for dynamic options callback in clerkMiddleware across express, react, and shared packages.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The pull request description provides a clear example of the new feature: a callback function passed to clerkMiddleware that dynamically selects configuration based on request hostname.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

pkg-pr-new · 2026-04-24T14:32:02Z

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8398

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8398

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8398

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8398

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@8398

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8398

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8398

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8398

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8398

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8398

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8398

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8398

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8398

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8398

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8398

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8398

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8398

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8398

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8398

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8398

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8398

commit: f48bd81

Derives a production publishable key from the current request hostname, falling back to the configured key for development instances (pk_test_). Built on the existing buildPublishableKey and isDevelopmentFromPublishableKey helpers. Re-exported from @clerk/react/internal so Replit and other multi-domain apps can use it without additional dependencies: import { publishableKeyFromHost } from '@clerk/react/internal' // React <ClerkProvider publishableKey={publishableKeyFromHost(window.location.host, process.env.VITE_CLERK_PUBLISHABLE_KEY)}> // Express (with the new clerkMiddleware callback) clerkMiddleware((req) => ({ publishableKey: publishableKeyFromHost(req.hostname, process.env.CLERK_PUBLISHABLE_KEY), }))

Add @clerk/express/internal re-exporting publishableKeyFromHost from @clerk/shared/keys. Mirrors the @clerk/react/internal pattern. Also simplifies publishableKeyFromHost to take only host — buildPublishableKey already handles dev vs prod detection via FAPI host patterns, so no fallback key parameter is needed. Usage: import { publishableKeyFromHost } from '@clerk/express/internal' clerkMiddleware((req) => ({ publishableKey: publishableKeyFromHost(req.hostname), }))

Without it, dev instances on localhost produce an incorrect pk_live_ key. If fallbackKey is a pk_test_ key it is returned as-is; otherwise the key is derived from the host for production multi-domain setups.

wobsoriano · 2026-04-24T20:01:11Z

+ if (fallbackKey && isDevelopmentFromPublishableKey(fallbackKey)) {
+ return fallbackKey;
+ }
+ return buildPublishableKey(`clerk.${host.toLowerCase()}`);


existing helper that converts a FAPI URL into a base64-encoded publishable key
https://github.com/clerk/javascript/blob/70bd92ba85539aefb880f33e5fcd8cc1f1199756/packages/shared/src/keys.ts#L38,L44

jacekradko · 2026-04-24T20:16:57Z

@@ -0,0 +1 @@
+export { publishableKeyFromHost } from '@clerk/shared/keys';


🤔 I am a little hesitant to add a whole new entrypoint to a package in a hotfix.. just seems a bit early for this

are you saying we should just export from @clerk/express or let them import as-is from @clerk/shared/keys?

For now I think I would suggest they import from @clerk/shared/keys until we are sure this is something we want to re-export from an SDK package.

…e docstring example

…lishableKeyFromHost

…s example

…mple

wobsoriano · 2026-04-24T13:27:32Z

Description

app.use(clerkMiddleware((req)=>({publishableKey: req.hostname==='domain-a.com' ? PK_A : PK_B,})));

Checklist

pnpm test runs as expected.
pnpm build runs as expected.
(If applicable) JSDoc comments have been added or updated for any package exports
(If applicable) Documentation has been updated

Type of change

Add ClerkMiddlewareOptionsCallback type so multi-domain/multi-tenant apps can resolve publishableKey and secretKey per request: app.use(clerkMiddleware((req) => ({ publishableKey: req.hostname === 'a.com' ? PK_A : PK_B, secretKey: req.hostname === 'a.com' ? SK_A : SK_B, }))); Static options path is unchanged. Callback path awaits the function result and creates the auth handler per request.

vercel · 2026-04-24T13:27:37Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Skipped		Apr 24, 2026 9:47pm

changeset-bot · 2026-04-24T13:27:38Z

🦋 Changeset detected

Latest commit: f48bd81

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 20 packages

Name	Type
@clerk/shared	Patch
@clerk/react	Patch
@clerk/express	Patch
@clerk/astro	Patch
@clerk/backend	Patch
@clerk/chrome-extension	Patch
@clerk/clerk-js	Patch
@clerk/expo-passkeys	Patch
@clerk/expo	Patch
@clerk/fastify	Patch
@clerk/hono	Patch
@clerk/localizations	Patch
@clerk/msw	Patch
@clerk/nextjs	Patch
@clerk/nuxt	Patch
@clerk/react-router	Patch
@clerk/tanstack-react-start	Patch
@clerk/testing	Patch
@clerk/ui	Patch
@clerk/vue	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

coderabbitai · 2026-04-24T14:29:39Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

📝 Walkthrough

Walkthrough

This PR enhances the Express middleware to support dynamic, request-based configuration through a callback pattern while introducing a cross-package utility for multi-domain setups. The clerkMiddleware function now accepts either static options or an async-capable callback that derives options from the incoming request. A new publishableKeyFromHost utility is added to the shared package and re-exported through internal entry points in both React and Express packages. Build configuration is extended to support the new internal export path, and comprehensive tests validate the callback behavior including Promise handling and request properties.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: adding support for dynamic options callback in clerkMiddleware across express, react, and shared packages.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The pull request description provides a clear example of the new feature: a callback function passed to clerkMiddleware that dynamically selects configuration based on request hostname.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

pkg-pr-new · 2026-04-24T14:32:02Z

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8398

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8398

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8398

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8398

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@8398

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8398

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8398

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8398

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8398

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8398

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8398

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8398

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8398

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8398

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8398

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8398

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8398

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8398

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8398

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8398

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8398

commit: f48bd81

Derives a production publishable key from the current request hostname, falling back to the configured key for development instances (pk_test_). Built on the existing buildPublishableKey and isDevelopmentFromPublishableKey helpers. Re-exported from @clerk/react/internal so Replit and other multi-domain apps can use it without additional dependencies: import { publishableKeyFromHost } from '@clerk/react/internal' // React <ClerkProvider publishableKey={publishableKeyFromHost(window.location.host, process.env.VITE_CLERK_PUBLISHABLE_KEY)}> // Express (with the new clerkMiddleware callback) clerkMiddleware((req) => ({ publishableKey: publishableKeyFromHost(req.hostname, process.env.CLERK_PUBLISHABLE_KEY), }))

Add @clerk/express/internal re-exporting publishableKeyFromHost from @clerk/shared/keys. Mirrors the @clerk/react/internal pattern. Also simplifies publishableKeyFromHost to take only host — buildPublishableKey already handles dev vs prod detection via FAPI host patterns, so no fallback key parameter is needed. Usage: import { publishableKeyFromHost } from '@clerk/express/internal' clerkMiddleware((req) => ({ publishableKey: publishableKeyFromHost(req.hostname), }))

Without it, dev instances on localhost produce an incorrect pk_live_ key. If fallbackKey is a pk_test_ key it is returned as-is; otherwise the key is derived from the host for production multi-domain setups.

wobsoriano · 2026-04-24T20:01:11Z

+ if (fallbackKey && isDevelopmentFromPublishableKey(fallbackKey)) {
+ return fallbackKey;
+ }
+ return buildPublishableKey(`clerk.${host.toLowerCase()}`);


existing helper that converts a FAPI URL into a base64-encoded publishable key
https://github.com/clerk/javascript/blob/70bd92ba85539aefb880f33e5fcd8cc1f1199756/packages/shared/src/keys.ts#L38,L44

jacekradko · 2026-04-24T20:16:57Z

@@ -0,0 +1 @@
+export { publishableKeyFromHost } from '@clerk/shared/keys';


🤔 I am a little hesitant to add a whole new entrypoint to a package in a hotfix.. just seems a bit early for this

are you saying we should just export from @clerk/express or let them import as-is from @clerk/shared/keys?

For now I think I would suggest they import from @clerk/shared/keys until we are sure this is something we want to re-export from an SDK package.

…e docstring example

…lishableKeyFromHost

…s example

…mple

wobsoriano · 2026-04-24T13:27:32Z

Description

app.use(clerkMiddleware((req)=>({publishableKey: req.hostname==='domain-a.com' ? PK_A : PK_B,})));

Checklist

pnpm test runs as expected.
pnpm build runs as expected.
(If applicable) JSDoc comments have been added or updated for any package exports
(If applicable) Documentation has been updated

Type of change

Add ClerkMiddlewareOptionsCallback type so multi-domain/multi-tenant apps can resolve publishableKey and secretKey per request: app.use(clerkMiddleware((req) => ({ publishableKey: req.hostname === 'a.com' ? PK_A : PK_B, secretKey: req.hostname === 'a.com' ? SK_A : SK_B, }))); Static options path is unchanged. Callback path awaits the function result and creates the auth handler per request.

vercel · 2026-04-24T13:27:37Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Skipped		Apr 24, 2026 9:47pm

changeset-bot · 2026-04-24T13:27:38Z

🦋 Changeset detected

Latest commit: f48bd81

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 20 packages

Name	Type
@clerk/shared	Patch
@clerk/react	Patch
@clerk/express	Patch
@clerk/astro	Patch
@clerk/backend	Patch
@clerk/chrome-extension	Patch
@clerk/clerk-js	Patch
@clerk/expo-passkeys	Patch
@clerk/expo	Patch
@clerk/fastify	Patch
@clerk/hono	Patch
@clerk/localizations	Patch
@clerk/msw	Patch
@clerk/nextjs	Patch
@clerk/nuxt	Patch
@clerk/react-router	Patch
@clerk/tanstack-react-start	Patch
@clerk/testing	Patch
@clerk/ui	Patch
@clerk/vue	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

coderabbitai · 2026-04-24T14:29:39Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

📝 Walkthrough

Walkthrough

This PR enhances the Express middleware to support dynamic, request-based configuration through a callback pattern while introducing a cross-package utility for multi-domain setups. The clerkMiddleware function now accepts either static options or an async-capable callback that derives options from the incoming request. A new publishableKeyFromHost utility is added to the shared package and re-exported through internal entry points in both React and Express packages. Build configuration is extended to support the new internal export path, and comprehensive tests validate the callback behavior including Promise handling and request properties.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: adding support for dynamic options callback in clerkMiddleware across express, react, and shared packages.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The pull request description provides a clear example of the new feature: a callback function passed to clerkMiddleware that dynamically selects configuration based on request hostname.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

pkg-pr-new · 2026-04-24T14:32:02Z

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8398

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8398

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8398

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8398

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@8398

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8398

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8398

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8398

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8398

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8398

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8398

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8398

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8398

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8398

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8398

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8398

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8398

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8398

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8398

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8398

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8398

commit: f48bd81

Derives a production publishable key from the current request hostname, falling back to the configured key for development instances (pk_test_). Built on the existing buildPublishableKey and isDevelopmentFromPublishableKey helpers. Re-exported from @clerk/react/internal so Replit and other multi-domain apps can use it without additional dependencies: import { publishableKeyFromHost } from '@clerk/react/internal' // React <ClerkProvider publishableKey={publishableKeyFromHost(window.location.host, process.env.VITE_CLERK_PUBLISHABLE_KEY)}> // Express (with the new clerkMiddleware callback) clerkMiddleware((req) => ({ publishableKey: publishableKeyFromHost(req.hostname, process.env.CLERK_PUBLISHABLE_KEY), }))

Add @clerk/express/internal re-exporting publishableKeyFromHost from @clerk/shared/keys. Mirrors the @clerk/react/internal pattern. Also simplifies publishableKeyFromHost to take only host — buildPublishableKey already handles dev vs prod detection via FAPI host patterns, so no fallback key parameter is needed. Usage: import { publishableKeyFromHost } from '@clerk/express/internal' clerkMiddleware((req) => ({ publishableKey: publishableKeyFromHost(req.hostname), }))

Without it, dev instances on localhost produce an incorrect pk_live_ key. If fallbackKey is a pk_test_ key it is returned as-is; otherwise the key is derived from the host for production multi-domain setups.

wobsoriano · 2026-04-24T20:01:11Z

+ if (fallbackKey && isDevelopmentFromPublishableKey(fallbackKey)) {
+ return fallbackKey;
+ }
+ return buildPublishableKey(`clerk.${host.toLowerCase()}`);


existing helper that converts a FAPI URL into a base64-encoded publishable key
https://github.com/clerk/javascript/blob/70bd92ba85539aefb880f33e5fcd8cc1f1199756/packages/shared/src/keys.ts#L38,L44

jacekradko · 2026-04-24T20:16:57Z

@@ -0,0 +1 @@
+export { publishableKeyFromHost } from '@clerk/shared/keys';


🤔 I am a little hesitant to add a whole new entrypoint to a package in a hotfix.. just seems a bit early for this

are you saying we should just export from @clerk/express or let them import as-is from @clerk/shared/keys?

For now I think I would suggest they import from @clerk/shared/keys until we are sure this is something we want to re-export from an SDK package.

…e docstring example

…lishableKeyFromHost

…s example

…mple

wobsoriano · 2026-04-24T13:27:32Z

Description

app.use(clerkMiddleware((req)=>({publishableKey: req.hostname==='domain-a.com' ? PK_A : PK_B,})));

Checklist

pnpm test runs as expected.
pnpm build runs as expected.
(If applicable) JSDoc comments have been added or updated for any package exports
(If applicable) Documentation has been updated

Type of change

Add ClerkMiddlewareOptionsCallback type so multi-domain/multi-tenant apps can resolve publishableKey and secretKey per request: app.use(clerkMiddleware((req) => ({ publishableKey: req.hostname === 'a.com' ? PK_A : PK_B, secretKey: req.hostname === 'a.com' ? SK_A : SK_B, }))); Static options path is unchanged. Callback path awaits the function result and creates the auth handler per request.

vercel · 2026-04-24T13:27:37Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Skipped		Apr 24, 2026 9:47pm

changeset-bot · 2026-04-24T13:27:38Z

🦋 Changeset detected

Latest commit: f48bd81

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 20 packages

Name	Type
@clerk/shared	Patch
@clerk/react	Patch
@clerk/express	Patch
@clerk/astro	Patch
@clerk/backend	Patch
@clerk/chrome-extension	Patch
@clerk/clerk-js	Patch
@clerk/expo-passkeys	Patch
@clerk/expo	Patch
@clerk/fastify	Patch
@clerk/hono	Patch
@clerk/localizations	Patch
@clerk/msw	Patch
@clerk/nextjs	Patch
@clerk/nuxt	Patch
@clerk/react-router	Patch
@clerk/tanstack-react-start	Patch
@clerk/testing	Patch
@clerk/ui	Patch
@clerk/vue	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

coderabbitai · 2026-04-24T14:29:39Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

📝 Walkthrough

Walkthrough

This PR enhances the Express middleware to support dynamic, request-based configuration through a callback pattern while introducing a cross-package utility for multi-domain setups. The clerkMiddleware function now accepts either static options or an async-capable callback that derives options from the incoming request. A new publishableKeyFromHost utility is added to the shared package and re-exported through internal entry points in both React and Express packages. Build configuration is extended to support the new internal export path, and comprehensive tests validate the callback behavior including Promise handling and request properties.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: adding support for dynamic options callback in clerkMiddleware across express, react, and shared packages.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The pull request description provides a clear example of the new feature: a callback function passed to clerkMiddleware that dynamically selects configuration based on request hostname.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

pkg-pr-new · 2026-04-24T14:32:02Z

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8398

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8398

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8398

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8398

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@8398

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8398

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8398

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8398

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8398

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8398

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8398

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8398

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8398

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8398

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8398

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8398

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8398

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8398

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8398

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8398

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8398

commit: f48bd81

Derives a production publishable key from the current request hostname, falling back to the configured key for development instances (pk_test_). Built on the existing buildPublishableKey and isDevelopmentFromPublishableKey helpers. Re-exported from @clerk/react/internal so Replit and other multi-domain apps can use it without additional dependencies: import { publishableKeyFromHost } from '@clerk/react/internal' // React <ClerkProvider publishableKey={publishableKeyFromHost(window.location.host, process.env.VITE_CLERK_PUBLISHABLE_KEY)}> // Express (with the new clerkMiddleware callback) clerkMiddleware((req) => ({ publishableKey: publishableKeyFromHost(req.hostname, process.env.CLERK_PUBLISHABLE_KEY), }))

Add @clerk/express/internal re-exporting publishableKeyFromHost from @clerk/shared/keys. Mirrors the @clerk/react/internal pattern. Also simplifies publishableKeyFromHost to take only host — buildPublishableKey already handles dev vs prod detection via FAPI host patterns, so no fallback key parameter is needed. Usage: import { publishableKeyFromHost } from '@clerk/express/internal' clerkMiddleware((req) => ({ publishableKey: publishableKeyFromHost(req.hostname), }))

Without it, dev instances on localhost produce an incorrect pk_live_ key. If fallbackKey is a pk_test_ key it is returned as-is; otherwise the key is derived from the host for production multi-domain setups.

wobsoriano · 2026-04-24T20:01:11Z

+ if (fallbackKey && isDevelopmentFromPublishableKey(fallbackKey)) {
+ return fallbackKey;
+ }
+ return buildPublishableKey(`clerk.${host.toLowerCase()}`);


existing helper that converts a FAPI URL into a base64-encoded publishable key
https://github.com/clerk/javascript/blob/70bd92ba85539aefb880f33e5fcd8cc1f1199756/packages/shared/src/keys.ts#L38,L44

jacekradko · 2026-04-24T20:16:57Z

@@ -0,0 +1 @@
+export { publishableKeyFromHost } from '@clerk/shared/keys';


🤔 I am a little hesitant to add a whole new entrypoint to a package in a hotfix.. just seems a bit early for this

are you saying we should just export from @clerk/express or let them import as-is from @clerk/shared/keys?

For now I think I would suggest they import from @clerk/shared/keys until we are sure this is something we want to re-export from an SDK package.

…e docstring example

…lishableKeyFromHost

…s example

…mple

wobsoriano · 2026-04-24T13:27:32Z

Description

app.use(clerkMiddleware((req)=>({publishableKey: req.hostname==='domain-a.com' ? PK_A : PK_B,})));

Checklist

pnpm test runs as expected.
pnpm build runs as expected.
(If applicable) JSDoc comments have been added or updated for any package exports
(If applicable) Documentation has been updated

Type of change

Add ClerkMiddlewareOptionsCallback type so multi-domain/multi-tenant apps can resolve publishableKey and secretKey per request: app.use(clerkMiddleware((req) => ({ publishableKey: req.hostname === 'a.com' ? PK_A : PK_B, secretKey: req.hostname === 'a.com' ? SK_A : SK_B, }))); Static options path is unchanged. Callback path awaits the function result and creates the auth handler per request.

vercel · 2026-04-24T13:27:37Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Skipped		Apr 24, 2026 9:47pm

changeset-bot · 2026-04-24T13:27:38Z

🦋 Changeset detected

Latest commit: f48bd81

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 20 packages

Name	Type
@clerk/shared	Patch
@clerk/react	Patch
@clerk/express	Patch
@clerk/astro	Patch
@clerk/backend	Patch
@clerk/chrome-extension	Patch
@clerk/clerk-js	Patch
@clerk/expo-passkeys	Patch
@clerk/expo	Patch
@clerk/fastify	Patch
@clerk/hono	Patch
@clerk/localizations	Patch
@clerk/msw	Patch
@clerk/nextjs	Patch
@clerk/nuxt	Patch
@clerk/react-router	Patch
@clerk/tanstack-react-start	Patch
@clerk/testing	Patch
@clerk/ui	Patch
@clerk/vue	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

coderabbitai · 2026-04-24T14:29:39Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

📝 Walkthrough

Walkthrough

This PR enhances the Express middleware to support dynamic, request-based configuration through a callback pattern while introducing a cross-package utility for multi-domain setups. The clerkMiddleware function now accepts either static options or an async-capable callback that derives options from the incoming request. A new publishableKeyFromHost utility is added to the shared package and re-exported through internal entry points in both React and Express packages. Build configuration is extended to support the new internal export path, and comprehensive tests validate the callback behavior including Promise handling and request properties.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: adding support for dynamic options callback in clerkMiddleware across express, react, and shared packages.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The pull request description provides a clear example of the new feature: a callback function passed to clerkMiddleware that dynamically selects configuration based on request hostname.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

pkg-pr-new · 2026-04-24T14:32:02Z

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8398

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8398

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8398

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8398

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@8398

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8398

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8398

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8398

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8398

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8398

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8398

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8398

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8398

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8398

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8398

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8398

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8398

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8398

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8398

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8398

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8398

commit: f48bd81

Derives a production publishable key from the current request hostname, falling back to the configured key for development instances (pk_test_). Built on the existing buildPublishableKey and isDevelopmentFromPublishableKey helpers. Re-exported from @clerk/react/internal so Replit and other multi-domain apps can use it without additional dependencies: import { publishableKeyFromHost } from '@clerk/react/internal' // React <ClerkProvider publishableKey={publishableKeyFromHost(window.location.host, process.env.VITE_CLERK_PUBLISHABLE_KEY)}> // Express (with the new clerkMiddleware callback) clerkMiddleware((req) => ({ publishableKey: publishableKeyFromHost(req.hostname, process.env.CLERK_PUBLISHABLE_KEY), }))

Add @clerk/express/internal re-exporting publishableKeyFromHost from @clerk/shared/keys. Mirrors the @clerk/react/internal pattern. Also simplifies publishableKeyFromHost to take only host — buildPublishableKey already handles dev vs prod detection via FAPI host patterns, so no fallback key parameter is needed. Usage: import { publishableKeyFromHost } from '@clerk/express/internal' clerkMiddleware((req) => ({ publishableKey: publishableKeyFromHost(req.hostname), }))

Without it, dev instances on localhost produce an incorrect pk_live_ key. If fallbackKey is a pk_test_ key it is returned as-is; otherwise the key is derived from the host for production multi-domain setups.

wobsoriano · 2026-04-24T20:01:11Z

+ if (fallbackKey && isDevelopmentFromPublishableKey(fallbackKey)) {
+ return fallbackKey;
+ }
+ return buildPublishableKey(`clerk.${host.toLowerCase()}`);


existing helper that converts a FAPI URL into a base64-encoded publishable key
https://github.com/clerk/javascript/blob/70bd92ba85539aefb880f33e5fcd8cc1f1199756/packages/shared/src/keys.ts#L38,L44

jacekradko · 2026-04-24T20:16:57Z

@@ -0,0 +1 @@
+export { publishableKeyFromHost } from '@clerk/shared/keys';


🤔 I am a little hesitant to add a whole new entrypoint to a package in a hotfix.. just seems a bit early for this

are you saying we should just export from @clerk/express or let them import as-is from @clerk/shared/keys?

For now I think I would suggest they import from @clerk/shared/keys until we are sure this is something we want to re-export from an SDK package.

…e docstring example

…lishableKeyFromHost

…s example

…mple

wobsoriano added 3 commits April 23, 2026 08:00

docs: add accounts portal OAuth consent refactor spec
866e5af

chore: remove doc
1a28062

github-actionsBot added the express label Apr 24, 2026

vercelBotdeployed to Preview April 24, 2026 13:27 View deployment

wobsoriano marked this pull request as ready for review April 24, 2026 14:27

wobsoriano added the do not merge label Apr 24, 2026

Merge branch 'main' into rob/express-sdk-dynamic-keys
26f6335

vercelBotdeployed to Preview April 24, 2026 14:28 View deployment

wobsoriano added 2 commits April 24, 2026 09:16

chore: add changeset
57f8b79

chore: update changeset
5edd005

vercelBotdeployed to Preview April 24, 2026 16:18 View deployment

wobsoriano removed the do not merge label Apr 24, 2026

thiskevinwang approved these changes Apr 24, 2026
View reviewed changes

wobsoriano added 4 commits April 24, 2026 12:44

fix(shared): restore fallbackKey param in publishableKeyFromHost
bb09a5a
Without it, dev instances on localhost produce an incorrect pk_live_ key. If fallbackKey is a pk_test_ key it is returned as-is; otherwise the key is derived from the host for production multi-domain setups.

update doc
70bd92b

github-actionsBot added the react label Apr 24, 2026

vercelBotdeployed to Preview April 24, 2026 20:01 View deployment

wobsoriano commented Apr 24, 2026
View reviewed changes

chore: add changeset for publishableKeyFromHost
d22bfd5

jacekradko reviewed Apr 24, 2026
View reviewed changes

Comment thread.changeset/new-kangaroos-search.md Outdated

vercelBotdeployed to Preview April 24, 2026 20:04 View deployment

wobsoriano added 2 commits April 24, 2026 13:04

chore: trim express changeset to high-level description
12b1749

chore: consolidate changesets
069ef1e

wobsoriano changed the title ~~feat(express): Support dynamic options callback in clerkMiddleware~~chore(express,react,shared): Support dynamic options callback in clerkMiddlewareApr 24, 2026

vercelBotdeployed to Preview April 24, 2026 20:06 View deployment

jacekradko reviewed Apr 24, 2026
View reviewed changes

Comment thread.changeset/brave-lions-fly.md Outdated

chore: split changesets by package group
08143ce

vercelBotdeployed to Preview April 24, 2026 20:12 View deployment

test(shared): add unit tests for publishableKeyFromHost
5dee2cc

jacekradko reviewed Apr 24, 2026
View reviewed changes

vercelBotdeployed to Preview April 24, 2026 20:17 View deployment

jacekradko reviewed Apr 24, 2026
View reviewed changes

Comment threadpackages/shared/src/keys.ts

jacekradko reviewed Apr 24, 2026
View reviewed changes

Comment threadpackages/shared/src/keys.ts Outdated

jacekradko reviewed Apr 24, 2026
View reviewed changes

Comment threadpackages/shared/src/keys.ts Outdated

fix(shared): Strip port from host in publishableKeyFromHost and updat…
a9a225e
…e docstring example

vercelBotdeployed to Preview April 24, 2026 20:40 View deployment

nikosdouvlis approved these changes Apr 24, 2026
View reviewed changes

Comment threadpackages/shared/src/keys.ts Outdated
Comment threadpackages/shared/src/keys.ts

fix(shared): Guard against empty host and add trust proxy note in pub…
ac4550b
…lishableKeyFromHost

vercelBotdeployed to Preview April 24, 2026 21:01 View deployment

fix(shared): Align empty host error message with codebase conventions
4c66694

vercelBotdeployed to Preview April 24, 2026 21:02 View deployment

refactor(express): Remove internal re-export of publishableKeyFromHost
62709fa

vercelBotdeployed to Preview April 24, 2026 21:26 View deployment

docs(shared): Show allowlist pattern in publishableKeyFromHost Expres…
14d8fd9
…s example

vercelBotdeployed to Preview April 24, 2026 21:46 View deployment

docs(express): Remove secretKey from clerkMiddleware dynamic keys exa…
f48bd81
…mple

vercelBottemporarily deployed to Preview April 24, 2026 21:47 Inactive

wobsoriano merged commit 083c4c5 into mainApr 24, 2026
42 checks passed

wobsoriano deleted the rob/express-sdk-dynamic-keys branch April 24, 2026 21:58

clerk-cookie mentioned this pull request Apr 24, 2026
ci(repo): Version packages #8389
Merged