feat(backend): support configurable Frontend API proxy URLs#9223

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
thiskevinwang merged 1 commit into from
Jul 23, 2026
Merged

feat(backend): support configurable Frontend API proxy URLs #9223

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions .changeset/bright-pandas-proxy.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
---
"@clerk/backend": minor
"@clerk/nextjs": minor
---

Add an `fapiUrl` option to Frontend API proxy helpers so requests can target a custom Clerk Frontend API URL.
99 changes: 99 additions & 0 deletions packages/backend/src/__tests__/proxy.test.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -83,14 +83,21 @@ describe('proxy', () => {
describe('clerkFrontendApiProxy', () => {
const mockFetch = vi.fn();
const originalFetch = global.fetch;
const originalFapiUrl = process.env.CLERK_FAPI_URL;

beforeEach(() => {
global.fetch = mockFetch;
mockFetch.mockReset();
delete process.env.CLERK_FAPI_URL;
});

afterEach(() => {
global.fetch = originalFetch;
if (originalFapiUrl === undefined) {
delete process.env.CLERK_FAPI_URL;
} else {
process.env.CLERK_FAPI_URL = originalFapiUrl;
}
});

it('returns error when publishableKey is missing', async () => {
Expand DownExpand Up@@ -197,6 +204,77 @@ describe('proxy', () => {
expect(response.status).toBe(200);
});

it('uses the configured FAPI URL over CLERK_FAPI_URL and the publishable key', async () => {
process.env.CLERK_FAPI_URL = 'https://frontend-api.clerkstage.dev';
mockFetch.mockResolvedValue(new Response(JSON.stringify({ client: {} }), { status: 200 }));

const request = new Request('https://example.com/__clerk/v1/client');

await clerkFrontendApiProxy(request, {
publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
secretKey: 'sk_test_xxx',
fapiUrl: 'http://localhost:8001/',
});

const [url, options] = mockFetch.mock.calls[0];
expect(url).toBe('http://localhost:8001/v1/client');
expect(options.headers.get('Host')).toBe('localhost:8001');
});
Comment on lines +207 to +222

@coderabbitaicoderabbitaiBotJul 23, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Document the new public fapiUrl option.

The linked Next.js middleware options table and delegated proxy-properties partial do not expose fapiUrl, leaving the new supported configuration undiscoverable. Update those docs alongside this API addition. As per coding guidelines, “Update documentation for API changes.”

🧰 Tools
🪛 Betterleaks (1.6.1)

[high] 214-214: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

(generic-api-key)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/backend/src/__tests__/proxy.test.ts` around lines 207 - 222, Update
the public Next.js middleware options documentation and delegated
proxy-properties partial to include the new fapiUrl option, describing its
purpose and configuration behavior consistently with clerkFrontendApiProxy and
its existing options. Ensure the option appears in both documented locations so
the supported API is discoverable.

Sources: Coding guidelines, Linked repositories


it('uses CLERK_FAPI_URL when no FAPI URL is configured', async () => {
process.env.CLERK_FAPI_URL = 'https://frontend-api.clerkstage.dev';
mockFetch.mockResolvedValue(new Response(JSON.stringify({ client: {} }), { status: 200 }));

const request = new Request('https://example.com/__clerk/v1/client');

await clerkFrontendApiProxy(request, {
publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
secretKey: 'sk_test_xxx',
});

expect(mockFetch.mock.calls[0][0]).toBe('https://frontend-api.clerkstage.dev/v1/client');
});
Comment on lines +224 to +236

@coderabbitaicoderabbitaiBotJul 23, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Cover trailing-slash normalization for CLERK_FAPI_URL.

This only verifies an environment URL without a trailing slash. Use https://frontend-api.clerkstage.dev/ here and retain the no-double-slash assertion, so the environment fallback contract is protected independently of the direct fapiUrl path.

🧰 Tools
🪛 Betterleaks (1.6.1)

[high] 231-231: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

(generic-api-key)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/backend/src/__tests__/proxy.test.ts` around lines 224 - 236, Update
the test “uses CLERK_FAPI_URL when no FAPI URL is configured” to set
CLERK_FAPI_URL with a trailing slash, while retaining the expected fetch URL
without a double slash. Keep the test focused on the environment fallback path
and leave the direct fapiUrl behavior unchanged.

Source: Coding guidelines


it.each([
['unsupported scheme', 'ftp://frontend-api.clerk.dev', undefined, 'FAPI URL must use http or https'],
[
'credentials',
'https://user:password@frontend-api.clerk.dev',
undefined,
'FAPI URL must not include credentials, a query string, or a hash',
],
[
'query string',
'https://frontend-api.clerk.dev?env=staging',
undefined,
'FAPI URL must not include credentials, a query string, or a hash',
],
[
'fragment',
'https://frontend-api.clerk.dev#staging',
undefined,
'FAPI URL must not include credentials, a query string, or a hash',
],
['invalid environment value', undefined, 'not-a-url', 'Invalid URL'],
])('returns a configuration error for an invalid FAPI URL with %s', async (_case, fapiUrl, envFapiUrl, message) => {
if (envFapiUrl) {
process.env.CLERK_FAPI_URL = envFapiUrl;
}
const request = new Request('https://example.com/__clerk/v1/client');

const response = await clerkFrontendApiProxy(request, {
publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
secretKey: 'sk_test_xxx',
...(fapiUrl ? { fapiUrl } : {}),
});

expect(response.status).toBe(500);
expect(mockFetch).not.toHaveBeenCalled();
await expect(response.json()).resolves.toMatchObject({
errors: [{ code: 'proxy_configuration_error', message }],
});
});

it('forwards POST request with body', async () => {
const mockResponse = new Response(JSON.stringify({ success: true }), {
status: 200,
Expand DownExpand Up@@ -477,6 +555,27 @@ describe('proxy', () => {
expect(response.headers.get('Location')).toBe('https://example.com/__clerk/v1/oauth/callback?code=123');
});

it('rewrites redirects from a configured FAPI URL', async () => {
const mockResponse = new Response(null, {
status: 302,
headers: {
Location: 'http://localhost:8001/v1/oauth/callback?code=123',
},
});
mockFetch.mockResolvedValue(mockResponse);

const request = new Request('https://example.com/__clerk/v1/oauth/authorize');

const response = await clerkFrontendApiProxy(request, {
publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
secretKey: 'sk_test_xxx',
fapiUrl: 'http://localhost:8001',
});

expect(response.status).toBe(302);
expect(response.headers.get('Location')).toBe('https://example.com/__clerk/v1/oauth/callback?code=123');
});

it('does not rewrite Location header for external redirects', async () => {
const mockResponse = new Response(null, {
status: 302,
Expand Down
36 changes: 34 additions & 2 deletions packages/backend/src/proxy.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -27,6 +27,11 @@ export interface FrontendApiProxyOptions {
* The Clerk secret key. Falls back to CLERK_SECRET_KEY env var.
*/
secretKey?: string;
/**
* The Clerk Frontend API URL. Falls back to the CLERK_FAPI_URL environment variable.
* If not provided, the URL is derived from the publishable key.
*/
fapiUrl?: string;
}

/**
Expand DownExpand Up@@ -111,6 +116,20 @@ export function stripTrailingSlashes(str: string): string {
return str;
}

function normalizeFapiUrl(fapiUrl: string): string {
const url = new URL(fapiUrl);

if (url.protocol !== 'http:' && url.protocol !== 'https:') {
throw new Error('FAPI URL must use http or https');
}

if (url.username || url.password || url.search || url.hash) {
throw new Error('FAPI URL must not include credentials, a query string, or a hash');
}

return stripTrailingSlashes(url.toString());
}

/**
* Checks if a request path matches the proxy path.
* @param request - The incoming request
Expand DownExpand Up@@ -233,10 +252,23 @@ export async function clerkFrontendApiProxy(request: Request, options?: Frontend
);
}

// Derive the FAPI URL and construct the target URL.
// Resolve the FAPI URL and construct the target URL.
// Use string concatenation instead of `new URL(path, base)` to avoid
// protocol-relative resolution (e.g., "//evil.com" resolving to a different host).
const fapiBaseUrl = fapiUrlFromPublishableKey(publishableKey);
let fapiBaseUrl: string;
try {
fapiBaseUrl = normalizeFapiUrl(
options?.fapiUrl ||
(typeof process !== 'undefined' ? process.env?.CLERK_FAPI_URL : undefined) ||
fapiUrlFromPublishableKey(publishableKey),
);
} catch (error) {
return createErrorResponse(
'proxy_configuration_error',
error instanceof Error ? error.message : 'Invalid FAPI URL',
500,
);
}
const fapiHost = new URL(fapiBaseUrl).host;
const targetPath = requestUrl.pathname.slice(proxyPath.length) || '/';
const targetUrl = new URL(`${fapiBaseUrl}${targetPath}`);
Expand Down
31 changes: 31 additions & 0 deletions packages/nextjs/src/server/__tests__/proxy.test.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';

import { createFrontendApiProxyHandlers } from '../proxy';

describe('createFrontendApiProxyHandlers', () => {
const mockFetch = vi.fn();
const originalFetch = global.fetch;

beforeEach(() => {
global.fetch = mockFetch;
mockFetch.mockReset();
});

afterEach(() => {
global.fetch = originalFetch;
});

it('forwards fapiUrl to the backend proxy', async () => {
mockFetch.mockResolvedValue(new Response(JSON.stringify({ client: {} }), { status: 200 }));
const request = new Request('https://example.com/__clerk/v1/client');
const handlers = createFrontendApiProxyHandlers({
publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
secretKey: 'sk_test_xxx',
fapiUrl: 'http://localhost:8001',
});

await handlers.GET(request);

expect(mockFetch.mock.calls[0][0]).toBe('http://localhost:8001/v1/client');
});
});
1 change: 1 addition & 0 deletions packages/nextjs/src/server/proxy.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -52,6 +52,7 @@ export async function clerkFrontendApiProxy(
proxyPath: options?.proxyPath || DEFAULT_PROXY_PATH,
publishableKey: options?.publishableKey || PUBLISHABLE_KEY,
secretKey: options?.secretKey || SECRET_KEY,
fapiUrl: options?.fapiUrl,
});
}

Expand Down
Loading
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
feat(backend): support configurable Frontend API proxy URLs#9223

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

thiskevinwang
merged 1 commit into

from

Jul 23, 2026
 Merged


feat(backend): support configurable Frontend API proxy URLs
#9223
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


6 changes: 6 additions & 0 deletions
.changeset/bright-pandas-proxy.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
---
"@clerk/backend": minor
"@clerk/nextjs": minor
---

Add an `fapiUrl` option to Frontend API proxy helpers so requests can target a custom Clerk Frontend API URL.

99 changes: 99 additions & 0 deletions
packages/backend/src/__tests__/proxy.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -83,14 +83,21 @@ describe('proxy', () => {
 describe('clerkFrontendApiProxy', () => {
 const mockFetch = vi.fn();
 const originalFetch = global.fetch;
 const originalFapiUrl = process.env.CLERK_FAPI_URL;

 beforeEach(() => {
 global.fetch = mockFetch;
 mockFetch.mockReset();
 delete process.env.CLERK_FAPI_URL;
 });

 afterEach(() => {
 global.fetch = originalFetch;
 if (originalFapiUrl === undefined) {
 delete process.env.CLERK_FAPI_URL;
 } else {
 process.env.CLERK_FAPI_URL = originalFapiUrl;
 }
 });

 it('returns error when publishableKey is missing', async () => {
Expand DownExpand Up@@ -197,6 +204,77 @@ describe('proxy', () => {
 expect(response.status).toBe(200);
 });

 it('uses the configured FAPI URL over CLERK_FAPI_URL and the publishable key', async () => {
 process.env.CLERK_FAPI_URL = 'https://frontend-api.clerkstage.dev';
 mockFetch.mockResolvedValue(new Response(JSON.stringify({ client: {} }), { status: 200 }));

 const request = new Request('https://example.com/__clerk/v1/client');

 await clerkFrontendApiProxy(request, {
 publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
 secretKey: 'sk_test_xxx',
 fapiUrl: 'http://localhost:8001/',
 });

 const [url, options] = mockFetch.mock.calls[0];
 expect(url).toBe('http://localhost:8001/v1/client');
 expect(options.headers.get('Host')).toBe('localhost:8001');
 });

Comment on lines

+207
 to 
+222

@coderabbitaicoderabbitaiBotJul 23, 2026

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Document the new public fapiUrl option.
The linked Next.js middleware options table and delegated proxy-properties partial do not expose fapiUrl, leaving the new supported configuration undiscoverable. Update those docs alongside this API addition. As per coding guidelines, “Update documentation for API changes.”
🧰 Tools
🪛 Betterleaks (1.6.1)
[high] 214-214: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/backend/src/__tests__/proxy.test.ts` around lines 207 - 222, Update
the public Next.js middleware options documentation and delegated
proxy-properties partial to include the new fapiUrl option, describing its
purpose and configuration behavior consistently with clerkFrontendApiProxy and
its existing options. Ensure the option appears in both documented locations so
the supported API is discoverable.

Sources: Coding guidelines, Linked repositories

 it('uses CLERK_FAPI_URL when no FAPI URL is configured', async () => {
 process.env.CLERK_FAPI_URL = 'https://frontend-api.clerkstage.dev';
 mockFetch.mockResolvedValue(new Response(JSON.stringify({ client: {} }), { status: 200 }));

 const request = new Request('https://example.com/__clerk/v1/client');

 await clerkFrontendApiProxy(request, {
 publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
 secretKey: 'sk_test_xxx',
 });

 expect(mockFetch.mock.calls[0][0]).toBe('https://frontend-api.clerkstage.dev/v1/client');
 });

Comment on lines

+224
 to 
+236

@coderabbitaicoderabbitaiBotJul 23, 2026

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Cover trailing-slash normalization for CLERK_FAPI_URL.
This only verifies an environment URL without a trailing slash. Use https://frontend-api.clerkstage.dev/ here and retain the no-double-slash assertion, so the environment fallback contract is protected independently of the direct fapiUrl path.
🧰 Tools
🪛 Betterleaks (1.6.1)
[high] 231-231: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/backend/src/__tests__/proxy.test.ts` around lines 224 - 236, Update
the test “uses CLERK_FAPI_URL when no FAPI URL is configured” to set
CLERK_FAPI_URL with a trailing slash, while retaining the expected fetch URL
without a double slash. Keep the test focused on the environment fallback path
and leave the direct fapiUrl behavior unchanged.

Source: Coding guidelines

 it.each([
 ['unsupported scheme', 'ftp://frontend-api.clerk.dev', undefined, 'FAPI URL must use http or https'],
 [
 'credentials',
 'https://user:password@frontend-api.clerk.dev',
 undefined,
 'FAPI URL must not include credentials, a query string, or a hash',
 ],
 [
 'query string',
 'https://frontend-api.clerk.dev?env=staging',
 undefined,
 'FAPI URL must not include credentials, a query string, or a hash',
 ],
 [
 'fragment',
 'https://frontend-api.clerk.dev#staging',
 undefined,
 'FAPI URL must not include credentials, a query string, or a hash',
 ],
 ['invalid environment value', undefined, 'not-a-url', 'Invalid URL'],
 ])('returns a configuration error for an invalid FAPI URL with %s', async (_case, fapiUrl, envFapiUrl, message) => {
 if (envFapiUrl) {
 process.env.CLERK_FAPI_URL = envFapiUrl;
 }
 const request = new Request('https://example.com/__clerk/v1/client');

 const response = await clerkFrontendApiProxy(request, {
 publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
 secretKey: 'sk_test_xxx',
 ...(fapiUrl ? { fapiUrl } : {}),
 });

 expect(response.status).toBe(500);
 expect(mockFetch).not.toHaveBeenCalled();
 await expect(response.json()).resolves.toMatchObject({
 errors: [{ code: 'proxy_configuration_error', message }],
 });
 });

 it('forwards POST request with body', async () => {
 const mockResponse = new Response(JSON.stringify({ success: true }), {
 status: 200,
Expand DownExpand Up@@ -477,6 +555,27 @@ describe('proxy', () => {
 expect(response.headers.get('Location')).toBe('https://example.com/__clerk/v1/oauth/callback?code=123');
 });

 it('rewrites redirects from a configured FAPI URL', async () => {
 const mockResponse = new Response(null, {
 status: 302,
 headers: {
 Location: 'http://localhost:8001/v1/oauth/callback?code=123',
 },
 });
 mockFetch.mockResolvedValue(mockResponse);

 const request = new Request('https://example.com/__clerk/v1/oauth/authorize');

 const response = await clerkFrontendApiProxy(request, {
 publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
 secretKey: 'sk_test_xxx',
 fapiUrl: 'http://localhost:8001',
 });

 expect(response.status).toBe(302);
 expect(response.headers.get('Location')).toBe('https://example.com/__clerk/v1/oauth/callback?code=123');
 });

 it('does not rewrite Location header for external redirects', async () => {
 const mockResponse = new Response(null, {
 status: 302,
Expand Down

36 changes: 34 additions & 2 deletions
packages/backend/src/proxy.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -27,6 +27,11 @@ export interface FrontendApiProxyOptions {
 * The Clerk secret key. Falls back to CLERK_SECRET_KEY env var.
 */
 secretKey?: string;
 /**
 * The Clerk Frontend API URL. Falls back to the CLERK_FAPI_URL environment variable.
 * If not provided, the URL is derived from the publishable key.
 */
 fapiUrl?: string;
}

/**
Expand DownExpand Up@@ -111,6 +116,20 @@ export function stripTrailingSlashes(str: string): string {
 return str;
}

function normalizeFapiUrl(fapiUrl: string): string {
 const url = new URL(fapiUrl);

 if (url.protocol !== 'http:' && url.protocol !== 'https:') {
 throw new Error('FAPI URL must use http or https');
 }

 if (url.username || url.password || url.search || url.hash) {
 throw new Error('FAPI URL must not include credentials, a query string, or a hash');
 }

 return stripTrailingSlashes(url.toString());
}

/**
 * Checks if a request path matches the proxy path.
 * @param request - The incoming request
Expand DownExpand Up@@ -233,10 +252,23 @@ export async function clerkFrontendApiProxy(request: Request, options?: Frontend
 );
 }

 // Derive the FAPI URL and construct the target URL.
 // Resolve the FAPI URL and construct the target URL.
 // Use string concatenation instead of `new URL(path, base)` to avoid
 // protocol-relative resolution (e.g., "//evil.com" resolving to a different host).
 const fapiBaseUrl = fapiUrlFromPublishableKey(publishableKey);
 let fapiBaseUrl: string;
 try {
 fapiBaseUrl = normalizeFapiUrl(
 options?.fapiUrl ||
 (typeof process !== 'undefined' ? process.env?.CLERK_FAPI_URL : undefined) ||
 fapiUrlFromPublishableKey(publishableKey),
 );
 } catch (error) {
 return createErrorResponse(
 'proxy_configuration_error',
 error instanceof Error ? error.message : 'Invalid FAPI URL',
 500,
 );
 }
 const fapiHost = new URL(fapiBaseUrl).host;
 const targetPath = requestUrl.pathname.slice(proxyPath.length) || '/';
 const targetUrl = new URL(`${fapiBaseUrl}${targetPath}`);
Expand Down

31 changes: 31 additions & 0 deletions
packages/nextjs/src/server/__tests__/proxy.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';

import { createFrontendApiProxyHandlers } from '../proxy';

describe('createFrontendApiProxyHandlers', () => {
 const mockFetch = vi.fn();
 const originalFetch = global.fetch;

 beforeEach(() => {
 global.fetch = mockFetch;
 mockFetch.mockReset();
 });

 afterEach(() => {
 global.fetch = originalFetch;
 });

 it('forwards fapiUrl to the backend proxy', async () => {
 mockFetch.mockResolvedValue(new Response(JSON.stringify({ client: {} }), { status: 200 }));
 const request = new Request('https://example.com/__clerk/v1/client');
 const handlers = createFrontendApiProxyHandlers({
 publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
 secretKey: 'sk_test_xxx',
 fapiUrl: 'http://localhost:8001',
 });

 await handlers.GET(request);

 expect(mockFetch.mock.calls[0][0]).toBe('http://localhost:8001/v1/client');
 });
});

1 change: 1 addition & 0 deletions
packages/nextjs/src/server/proxy.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -52,6 +52,7 @@ export async function clerkFrontendApiProxy(
 proxyPath: options?.proxyPath || DEFAULT_PROXY_PATH,
 publishableKey: options?.publishableKey || PUBLISHABLE_KEY,
 secretKey: options?.secretKey || SECRET_KEY,
 fapiUrl: options?.fapiUrl,
 });
}

Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(backend): support configurable Frontend API proxy URLs#9223

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

thiskevinwang
merged 1 commit into

from

Jul 23, 2026
 Merged


feat(backend): support configurable Frontend API proxy URLs
#9223
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


6 changes: 6 additions & 0 deletions
.changeset/bright-pandas-proxy.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
---
"@clerk/backend": minor
"@clerk/nextjs": minor
---

Add an `fapiUrl` option to Frontend API proxy helpers so requests can target a custom Clerk Frontend API URL.

99 changes: 99 additions & 0 deletions
packages/backend/src/__tests__/proxy.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -83,14 +83,21 @@ describe('proxy', () => {
 describe('clerkFrontendApiProxy', () => {
 const mockFetch = vi.fn();
 const originalFetch = global.fetch;
 const originalFapiUrl = process.env.CLERK_FAPI_URL;

 beforeEach(() => {
 global.fetch = mockFetch;
 mockFetch.mockReset();
 delete process.env.CLERK_FAPI_URL;
 });

 afterEach(() => {
 global.fetch = originalFetch;
 if (originalFapiUrl === undefined) {
 delete process.env.CLERK_FAPI_URL;
 } else {
 process.env.CLERK_FAPI_URL = originalFapiUrl;
 }
 });

 it('returns error when publishableKey is missing', async () => {
Expand DownExpand Up@@ -197,6 +204,77 @@ describe('proxy', () => {
 expect(response.status).toBe(200);
 });

 it('uses the configured FAPI URL over CLERK_FAPI_URL and the publishable key', async () => {
 process.env.CLERK_FAPI_URL = 'https://frontend-api.clerkstage.dev';
 mockFetch.mockResolvedValue(new Response(JSON.stringify({ client: {} }), { status: 200 }));

 const request = new Request('https://example.com/__clerk/v1/client');

 await clerkFrontendApiProxy(request, {
 publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
 secretKey: 'sk_test_xxx',
 fapiUrl: 'http://localhost:8001/',
 });

 const [url, options] = mockFetch.mock.calls[0];
 expect(url).toBe('http://localhost:8001/v1/client');
 expect(options.headers.get('Host')).toBe('localhost:8001');
 });

Comment on lines

+207
 to 
+222

@coderabbitaicoderabbitaiBotJul 23, 2026

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Document the new public fapiUrl option.
The linked Next.js middleware options table and delegated proxy-properties partial do not expose fapiUrl, leaving the new supported configuration undiscoverable. Update those docs alongside this API addition. As per coding guidelines, “Update documentation for API changes.”
🧰 Tools
🪛 Betterleaks (1.6.1)
[high] 214-214: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/backend/src/__tests__/proxy.test.ts` around lines 207 - 222, Update
the public Next.js middleware options documentation and delegated
proxy-properties partial to include the new fapiUrl option, describing its
purpose and configuration behavior consistently with clerkFrontendApiProxy and
its existing options. Ensure the option appears in both documented locations so
the supported API is discoverable.

Sources: Coding guidelines, Linked repositories

 it('uses CLERK_FAPI_URL when no FAPI URL is configured', async () => {
 process.env.CLERK_FAPI_URL = 'https://frontend-api.clerkstage.dev';
 mockFetch.mockResolvedValue(new Response(JSON.stringify({ client: {} }), { status: 200 }));

 const request = new Request('https://example.com/__clerk/v1/client');

 await clerkFrontendApiProxy(request, {
 publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
 secretKey: 'sk_test_xxx',
 });

 expect(mockFetch.mock.calls[0][0]).toBe('https://frontend-api.clerkstage.dev/v1/client');
 });

Comment on lines

+224
 to 
+236

@coderabbitaicoderabbitaiBotJul 23, 2026

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Cover trailing-slash normalization for CLERK_FAPI_URL.
This only verifies an environment URL without a trailing slash. Use https://frontend-api.clerkstage.dev/ here and retain the no-double-slash assertion, so the environment fallback contract is protected independently of the direct fapiUrl path.
🧰 Tools
🪛 Betterleaks (1.6.1)
[high] 231-231: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/backend/src/__tests__/proxy.test.ts` around lines 224 - 236, Update
the test “uses CLERK_FAPI_URL when no FAPI URL is configured” to set
CLERK_FAPI_URL with a trailing slash, while retaining the expected fetch URL
without a double slash. Keep the test focused on the environment fallback path
and leave the direct fapiUrl behavior unchanged.

Source: Coding guidelines

 it.each([
 ['unsupported scheme', 'ftp://frontend-api.clerk.dev', undefined, 'FAPI URL must use http or https'],
 [
 'credentials',
 'https://user:password@frontend-api.clerk.dev',
 undefined,
 'FAPI URL must not include credentials, a query string, or a hash',
 ],
 [
 'query string',
 'https://frontend-api.clerk.dev?env=staging',
 undefined,
 'FAPI URL must not include credentials, a query string, or a hash',
 ],
 [
 'fragment',
 'https://frontend-api.clerk.dev#staging',
 undefined,
 'FAPI URL must not include credentials, a query string, or a hash',
 ],
 ['invalid environment value', undefined, 'not-a-url', 'Invalid URL'],
 ])('returns a configuration error for an invalid FAPI URL with %s', async (_case, fapiUrl, envFapiUrl, message) => {
 if (envFapiUrl) {
 process.env.CLERK_FAPI_URL = envFapiUrl;
 }
 const request = new Request('https://example.com/__clerk/v1/client');

 const response = await clerkFrontendApiProxy(request, {
 publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
 secretKey: 'sk_test_xxx',
 ...(fapiUrl ? { fapiUrl } : {}),
 });

 expect(response.status).toBe(500);
 expect(mockFetch).not.toHaveBeenCalled();
 await expect(response.json()).resolves.toMatchObject({
 errors: [{ code: 'proxy_configuration_error', message }],
 });
 });

 it('forwards POST request with body', async () => {
 const mockResponse = new Response(JSON.stringify({ success: true }), {
 status: 200,
Expand DownExpand Up@@ -477,6 +555,27 @@ describe('proxy', () => {
 expect(response.headers.get('Location')).toBe('https://example.com/__clerk/v1/oauth/callback?code=123');
 });

 it('rewrites redirects from a configured FAPI URL', async () => {
 const mockResponse = new Response(null, {
 status: 302,
 headers: {
 Location: 'http://localhost:8001/v1/oauth/callback?code=123',
 },
 });
 mockFetch.mockResolvedValue(mockResponse);

 const request = new Request('https://example.com/__clerk/v1/oauth/authorize');

 const response = await clerkFrontendApiProxy(request, {
 publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
 secretKey: 'sk_test_xxx',
 fapiUrl: 'http://localhost:8001',
 });

 expect(response.status).toBe(302);
 expect(response.headers.get('Location')).toBe('https://example.com/__clerk/v1/oauth/callback?code=123');
 });

 it('does not rewrite Location header for external redirects', async () => {
 const mockResponse = new Response(null, {
 status: 302,
Expand Down

36 changes: 34 additions & 2 deletions
packages/backend/src/proxy.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -27,6 +27,11 @@ export interface FrontendApiProxyOptions {
 * The Clerk secret key. Falls back to CLERK_SECRET_KEY env var.
 */
 secretKey?: string;
 /**
 * The Clerk Frontend API URL. Falls back to the CLERK_FAPI_URL environment variable.
 * If not provided, the URL is derived from the publishable key.
 */
 fapiUrl?: string;
}

/**
Expand DownExpand Up@@ -111,6 +116,20 @@ export function stripTrailingSlashes(str: string): string {
 return str;
}

function normalizeFapiUrl(fapiUrl: string): string {
 const url = new URL(fapiUrl);

 if (url.protocol !== 'http:' && url.protocol !== 'https:') {
 throw new Error('FAPI URL must use http or https');
 }

 if (url.username || url.password || url.search || url.hash) {
 throw new Error('FAPI URL must not include credentials, a query string, or a hash');
 }

 return stripTrailingSlashes(url.toString());
}

/**
 * Checks if a request path matches the proxy path.
 * @param request - The incoming request
Expand DownExpand Up@@ -233,10 +252,23 @@ export async function clerkFrontendApiProxy(request: Request, options?: Frontend
 );
 }

 // Derive the FAPI URL and construct the target URL.
 // Resolve the FAPI URL and construct the target URL.
 // Use string concatenation instead of `new URL(path, base)` to avoid
 // protocol-relative resolution (e.g., "//evil.com" resolving to a different host).
 const fapiBaseUrl = fapiUrlFromPublishableKey(publishableKey);
 let fapiBaseUrl: string;
 try {
 fapiBaseUrl = normalizeFapiUrl(
 options?.fapiUrl ||
 (typeof process !== 'undefined' ? process.env?.CLERK_FAPI_URL : undefined) ||
 fapiUrlFromPublishableKey(publishableKey),
 );
 } catch (error) {
 return createErrorResponse(
 'proxy_configuration_error',
 error instanceof Error ? error.message : 'Invalid FAPI URL',
 500,
 );
 }
 const fapiHost = new URL(fapiBaseUrl).host;
 const targetPath = requestUrl.pathname.slice(proxyPath.length) || '/';
 const targetUrl = new URL(`${fapiBaseUrl}${targetPath}`);
Expand Down

31 changes: 31 additions & 0 deletions
packages/nextjs/src/server/__tests__/proxy.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';

import { createFrontendApiProxyHandlers } from '../proxy';

describe('createFrontendApiProxyHandlers', () => {
 const mockFetch = vi.fn();
 const originalFetch = global.fetch;

 beforeEach(() => {
 global.fetch = mockFetch;
 mockFetch.mockReset();
 });

 afterEach(() => {
 global.fetch = originalFetch;
 });

 it('forwards fapiUrl to the backend proxy', async () => {
 mockFetch.mockResolvedValue(new Response(JSON.stringify({ client: {} }), { status: 200 }));
 const request = new Request('https://example.com/__clerk/v1/client');
 const handlers = createFrontendApiProxyHandlers({
 publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
 secretKey: 'sk_test_xxx',
 fapiUrl: 'http://localhost:8001',
 });

 await handlers.GET(request);

 expect(mockFetch.mock.calls[0][0]).toBe('http://localhost:8001/v1/client');
 });
});

1 change: 1 addition & 0 deletions
packages/nextjs/src/server/proxy.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -52,6 +52,7 @@ export async function clerkFrontendApiProxy(
 proxyPath: options?.proxyPath || DEFAULT_PROXY_PATH,
 publishableKey: options?.publishableKey || PUBLISHABLE_KEY,
 secretKey: options?.secretKey || SECRET_KEY,
 fapiUrl: options?.fapiUrl,
 });
}

Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(backend): support configurable Frontend API proxy URLs#9223

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

thiskevinwang
merged 1 commit into

from

Jul 23, 2026
 Merged


feat(backend): support configurable Frontend API proxy URLs
#9223
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


6 changes: 6 additions & 0 deletions
.changeset/bright-pandas-proxy.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
---
"@clerk/backend": minor
"@clerk/nextjs": minor
---

Add an `fapiUrl` option to Frontend API proxy helpers so requests can target a custom Clerk Frontend API URL.

99 changes: 99 additions & 0 deletions
packages/backend/src/__tests__/proxy.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -83,14 +83,21 @@ describe('proxy', () => {
 describe('clerkFrontendApiProxy', () => {
 const mockFetch = vi.fn();
 const originalFetch = global.fetch;
 const originalFapiUrl = process.env.CLERK_FAPI_URL;

 beforeEach(() => {
 global.fetch = mockFetch;
 mockFetch.mockReset();
 delete process.env.CLERK_FAPI_URL;
 });

 afterEach(() => {
 global.fetch = originalFetch;
 if (originalFapiUrl === undefined) {
 delete process.env.CLERK_FAPI_URL;
 } else {
 process.env.CLERK_FAPI_URL = originalFapiUrl;
 }
 });

 it('returns error when publishableKey is missing', async () => {
Expand DownExpand Up@@ -197,6 +204,77 @@ describe('proxy', () => {
 expect(response.status).toBe(200);
 });

 it('uses the configured FAPI URL over CLERK_FAPI_URL and the publishable key', async () => {
 process.env.CLERK_FAPI_URL = 'https://frontend-api.clerkstage.dev';
 mockFetch.mockResolvedValue(new Response(JSON.stringify({ client: {} }), { status: 200 }));

 const request = new Request('https://example.com/__clerk/v1/client');

 await clerkFrontendApiProxy(request, {
 publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
 secretKey: 'sk_test_xxx',
 fapiUrl: 'http://localhost:8001/',
 });

 const [url, options] = mockFetch.mock.calls[0];
 expect(url).toBe('http://localhost:8001/v1/client');
 expect(options.headers.get('Host')).toBe('localhost:8001');
 });

Comment on lines

+207
 to 
+222

@coderabbitaicoderabbitaiBotJul 23, 2026

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Document the new public fapiUrl option.
The linked Next.js middleware options table and delegated proxy-properties partial do not expose fapiUrl, leaving the new supported configuration undiscoverable. Update those docs alongside this API addition. As per coding guidelines, “Update documentation for API changes.”
🧰 Tools
🪛 Betterleaks (1.6.1)
[high] 214-214: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/backend/src/__tests__/proxy.test.ts` around lines 207 - 222, Update
the public Next.js middleware options documentation and delegated
proxy-properties partial to include the new fapiUrl option, describing its
purpose and configuration behavior consistently with clerkFrontendApiProxy and
its existing options. Ensure the option appears in both documented locations so
the supported API is discoverable.

Sources: Coding guidelines, Linked repositories

 it('uses CLERK_FAPI_URL when no FAPI URL is configured', async () => {
 process.env.CLERK_FAPI_URL = 'https://frontend-api.clerkstage.dev';
 mockFetch.mockResolvedValue(new Response(JSON.stringify({ client: {} }), { status: 200 }));

 const request = new Request('https://example.com/__clerk/v1/client');

 await clerkFrontendApiProxy(request, {
 publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
 secretKey: 'sk_test_xxx',
 });

 expect(mockFetch.mock.calls[0][0]).toBe('https://frontend-api.clerkstage.dev/v1/client');
 });

Comment on lines

+224
 to 
+236

@coderabbitaicoderabbitaiBotJul 23, 2026

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Cover trailing-slash normalization for CLERK_FAPI_URL.
This only verifies an environment URL without a trailing slash. Use https://frontend-api.clerkstage.dev/ here and retain the no-double-slash assertion, so the environment fallback contract is protected independently of the direct fapiUrl path.
🧰 Tools
🪛 Betterleaks (1.6.1)
[high] 231-231: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/backend/src/__tests__/proxy.test.ts` around lines 224 - 236, Update
the test “uses CLERK_FAPI_URL when no FAPI URL is configured” to set
CLERK_FAPI_URL with a trailing slash, while retaining the expected fetch URL
without a double slash. Keep the test focused on the environment fallback path
and leave the direct fapiUrl behavior unchanged.

Source: Coding guidelines

 it.each([
 ['unsupported scheme', 'ftp://frontend-api.clerk.dev', undefined, 'FAPI URL must use http or https'],
 [
 'credentials',
 'https://user:password@frontend-api.clerk.dev',
 undefined,
 'FAPI URL must not include credentials, a query string, or a hash',
 ],
 [
 'query string',
 'https://frontend-api.clerk.dev?env=staging',
 undefined,
 'FAPI URL must not include credentials, a query string, or a hash',
 ],
 [
 'fragment',
 'https://frontend-api.clerk.dev#staging',
 undefined,
 'FAPI URL must not include credentials, a query string, or a hash',
 ],
 ['invalid environment value', undefined, 'not-a-url', 'Invalid URL'],
 ])('returns a configuration error for an invalid FAPI URL with %s', async (_case, fapiUrl, envFapiUrl, message) => {
 if (envFapiUrl) {
 process.env.CLERK_FAPI_URL = envFapiUrl;
 }
 const request = new Request('https://example.com/__clerk/v1/client');

 const response = await clerkFrontendApiProxy(request, {
 publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
 secretKey: 'sk_test_xxx',
 ...(fapiUrl ? { fapiUrl } : {}),
 });

 expect(response.status).toBe(500);
 expect(mockFetch).not.toHaveBeenCalled();
 await expect(response.json()).resolves.toMatchObject({
 errors: [{ code: 'proxy_configuration_error', message }],
 });
 });

 it('forwards POST request with body', async () => {
 const mockResponse = new Response(JSON.stringify({ success: true }), {
 status: 200,
Expand DownExpand Up@@ -477,6 +555,27 @@ describe('proxy', () => {
 expect(response.headers.get('Location')).toBe('https://example.com/__clerk/v1/oauth/callback?code=123');
 });

 it('rewrites redirects from a configured FAPI URL', async () => {
 const mockResponse = new Response(null, {
 status: 302,
 headers: {
 Location: 'http://localhost:8001/v1/oauth/callback?code=123',
 },
 });
 mockFetch.mockResolvedValue(mockResponse);

 const request = new Request('https://example.com/__clerk/v1/oauth/authorize');

 const response = await clerkFrontendApiProxy(request, {
 publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
 secretKey: 'sk_test_xxx',
 fapiUrl: 'http://localhost:8001',
 });

 expect(response.status).toBe(302);
 expect(response.headers.get('Location')).toBe('https://example.com/__clerk/v1/oauth/callback?code=123');
 });

 it('does not rewrite Location header for external redirects', async () => {
 const mockResponse = new Response(null, {
 status: 302,
Expand Down

36 changes: 34 additions & 2 deletions
packages/backend/src/proxy.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -27,6 +27,11 @@ export interface FrontendApiProxyOptions {
 * The Clerk secret key. Falls back to CLERK_SECRET_KEY env var.
 */
 secretKey?: string;
 /**
 * The Clerk Frontend API URL. Falls back to the CLERK_FAPI_URL environment variable.
 * If not provided, the URL is derived from the publishable key.
 */
 fapiUrl?: string;
}

/**
Expand DownExpand Up@@ -111,6 +116,20 @@ export function stripTrailingSlashes(str: string): string {
 return str;
}

function normalizeFapiUrl(fapiUrl: string): string {
 const url = new URL(fapiUrl);

 if (url.protocol !== 'http:' && url.protocol !== 'https:') {
 throw new Error('FAPI URL must use http or https');
 }

 if (url.username || url.password || url.search || url.hash) {
 throw new Error('FAPI URL must not include credentials, a query string, or a hash');
 }

 return stripTrailingSlashes(url.toString());
}

/**
 * Checks if a request path matches the proxy path.
 * @param request - The incoming request
Expand DownExpand Up@@ -233,10 +252,23 @@ export async function clerkFrontendApiProxy(request: Request, options?: Frontend
 );
 }

 // Derive the FAPI URL and construct the target URL.
 // Resolve the FAPI URL and construct the target URL.
 // Use string concatenation instead of `new URL(path, base)` to avoid
 // protocol-relative resolution (e.g., "//evil.com" resolving to a different host).
 const fapiBaseUrl = fapiUrlFromPublishableKey(publishableKey);
 let fapiBaseUrl: string;
 try {
 fapiBaseUrl = normalizeFapiUrl(
 options?.fapiUrl ||
 (typeof process !== 'undefined' ? process.env?.CLERK_FAPI_URL : undefined) ||
 fapiUrlFromPublishableKey(publishableKey),
 );
 } catch (error) {
 return createErrorResponse(
 'proxy_configuration_error',
 error instanceof Error ? error.message : 'Invalid FAPI URL',
 500,
 );
 }
 const fapiHost = new URL(fapiBaseUrl).host;
 const targetPath = requestUrl.pathname.slice(proxyPath.length) || '/';
 const targetUrl = new URL(`${fapiBaseUrl}${targetPath}`);
Expand Down

31 changes: 31 additions & 0 deletions
packages/nextjs/src/server/__tests__/proxy.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';

import { createFrontendApiProxyHandlers } from '../proxy';

describe('createFrontendApiProxyHandlers', () => {
 const mockFetch = vi.fn();
 const originalFetch = global.fetch;

 beforeEach(() => {
 global.fetch = mockFetch;
 mockFetch.mockReset();
 });

 afterEach(() => {
 global.fetch = originalFetch;
 });

 it('forwards fapiUrl to the backend proxy', async () => {
 mockFetch.mockResolvedValue(new Response(JSON.stringify({ client: {} }), { status: 200 }));
 const request = new Request('https://example.com/__clerk/v1/client');
 const handlers = createFrontendApiProxyHandlers({
 publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
 secretKey: 'sk_test_xxx',
 fapiUrl: 'http://localhost:8001',
 });

 await handlers.GET(request);

 expect(mockFetch.mock.calls[0][0]).toBe('http://localhost:8001/v1/client');
 });
});

1 change: 1 addition & 0 deletions
packages/nextjs/src/server/proxy.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -52,6 +52,7 @@ export async function clerkFrontendApiProxy(
 proxyPath: options?.proxyPath || DEFAULT_PROXY_PATH,
 publishableKey: options?.publishableKey || PUBLISHABLE_KEY,
 secretKey: options?.secretKey || SECRET_KEY,
 fapiUrl: options?.fapiUrl,
 });
}

Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
feat(backend): support configurable Frontend API proxy URLs#9223

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

thiskevinwang
merged 1 commit into

from

Jul 23, 2026
 Merged


feat(backend): support configurable Frontend API proxy URLs
#9223
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


6 changes: 6 additions & 0 deletions
.changeset/bright-pandas-proxy.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
---
"@clerk/backend": minor
"@clerk/nextjs": minor
---

Add an `fapiUrl` option to Frontend API proxy helpers so requests can target a custom Clerk Frontend API URL.

99 changes: 99 additions & 0 deletions
packages/backend/src/__tests__/proxy.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -83,14 +83,21 @@ describe('proxy', () => {
 describe('clerkFrontendApiProxy', () => {
 const mockFetch = vi.fn();
 const originalFetch = global.fetch;
 const originalFapiUrl = process.env.CLERK_FAPI_URL;

 beforeEach(() => {
 global.fetch = mockFetch;
 mockFetch.mockReset();
 delete process.env.CLERK_FAPI_URL;
 });

 afterEach(() => {
 global.fetch = originalFetch;
 if (originalFapiUrl === undefined) {
 delete process.env.CLERK_FAPI_URL;
 } else {
 process.env.CLERK_FAPI_URL = originalFapiUrl;
 }
 });

 it('returns error when publishableKey is missing', async () => {
Expand DownExpand Up@@ -197,6 +204,77 @@ describe('proxy', () => {
 expect(response.status).toBe(200);
 });

 it('uses the configured FAPI URL over CLERK_FAPI_URL and the publishable key', async () => {
 process.env.CLERK_FAPI_URL = 'https://frontend-api.clerkstage.dev';
 mockFetch.mockResolvedValue(new Response(JSON.stringify({ client: {} }), { status: 200 }));

 const request = new Request('https://example.com/__clerk/v1/client');

 await clerkFrontendApiProxy(request, {
 publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
 secretKey: 'sk_test_xxx',
 fapiUrl: 'http://localhost:8001/',
 });

 const [url, options] = mockFetch.mock.calls[0];
 expect(url).toBe('http://localhost:8001/v1/client');
 expect(options.headers.get('Host')).toBe('localhost:8001');
 });

Comment on lines

+207
 to 
+222

@coderabbitaicoderabbitaiBotJul 23, 2026

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Document the new public fapiUrl option.
The linked Next.js middleware options table and delegated proxy-properties partial do not expose fapiUrl, leaving the new supported configuration undiscoverable. Update those docs alongside this API addition. As per coding guidelines, “Update documentation for API changes.”
🧰 Tools
🪛 Betterleaks (1.6.1)
[high] 214-214: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/backend/src/__tests__/proxy.test.ts` around lines 207 - 222, Update
the public Next.js middleware options documentation and delegated
proxy-properties partial to include the new fapiUrl option, describing its
purpose and configuration behavior consistently with clerkFrontendApiProxy and
its existing options. Ensure the option appears in both documented locations so
the supported API is discoverable.

Sources: Coding guidelines, Linked repositories

 it('uses CLERK_FAPI_URL when no FAPI URL is configured', async () => {
 process.env.CLERK_FAPI_URL = 'https://frontend-api.clerkstage.dev';
 mockFetch.mockResolvedValue(new Response(JSON.stringify({ client: {} }), { status: 200 }));

 const request = new Request('https://example.com/__clerk/v1/client');

 await clerkFrontendApiProxy(request, {
 publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
 secretKey: 'sk_test_xxx',
 });

 expect(mockFetch.mock.calls[0][0]).toBe('https://frontend-api.clerkstage.dev/v1/client');
 });

Comment on lines

+224
 to 
+236

@coderabbitaicoderabbitaiBotJul 23, 2026

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Cover trailing-slash normalization for CLERK_FAPI_URL.
This only verifies an environment URL without a trailing slash. Use https://frontend-api.clerkstage.dev/ here and retain the no-double-slash assertion, so the environment fallback contract is protected independently of the direct fapiUrl path.
🧰 Tools
🪛 Betterleaks (1.6.1)
[high] 231-231: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/backend/src/__tests__/proxy.test.ts` around lines 224 - 236, Update
the test “uses CLERK_FAPI_URL when no FAPI URL is configured” to set
CLERK_FAPI_URL with a trailing slash, while retaining the expected fetch URL
without a double slash. Keep the test focused on the environment fallback path
and leave the direct fapiUrl behavior unchanged.

Source: Coding guidelines

 it.each([
 ['unsupported scheme', 'ftp://frontend-api.clerk.dev', undefined, 'FAPI URL must use http or https'],
 [
 'credentials',
 'https://user:password@frontend-api.clerk.dev',
 undefined,
 'FAPI URL must not include credentials, a query string, or a hash',
 ],
 [
 'query string',
 'https://frontend-api.clerk.dev?env=staging',
 undefined,
 'FAPI URL must not include credentials, a query string, or a hash',
 ],
 [
 'fragment',
 'https://frontend-api.clerk.dev#staging',
 undefined,
 'FAPI URL must not include credentials, a query string, or a hash',
 ],
 ['invalid environment value', undefined, 'not-a-url', 'Invalid URL'],
 ])('returns a configuration error for an invalid FAPI URL with %s', async (_case, fapiUrl, envFapiUrl, message) => {
 if (envFapiUrl) {
 process.env.CLERK_FAPI_URL = envFapiUrl;
 }
 const request = new Request('https://example.com/__clerk/v1/client');

 const response = await clerkFrontendApiProxy(request, {
 publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
 secretKey: 'sk_test_xxx',
 ...(fapiUrl ? { fapiUrl } : {}),
 });

 expect(response.status).toBe(500);
 expect(mockFetch).not.toHaveBeenCalled();
 await expect(response.json()).resolves.toMatchObject({
 errors: [{ code: 'proxy_configuration_error', message }],
 });
 });

 it('forwards POST request with body', async () => {
 const mockResponse = new Response(JSON.stringify({ success: true }), {
 status: 200,
Expand DownExpand Up@@ -477,6 +555,27 @@ describe('proxy', () => {
 expect(response.headers.get('Location')).toBe('https://example.com/__clerk/v1/oauth/callback?code=123');
 });

 it('rewrites redirects from a configured FAPI URL', async () => {
 const mockResponse = new Response(null, {
 status: 302,
 headers: {
 Location: 'http://localhost:8001/v1/oauth/callback?code=123',
 },
 });
 mockFetch.mockResolvedValue(mockResponse);

 const request = new Request('https://example.com/__clerk/v1/oauth/authorize');

 const response = await clerkFrontendApiProxy(request, {
 publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
 secretKey: 'sk_test_xxx',
 fapiUrl: 'http://localhost:8001',
 });

 expect(response.status).toBe(302);
 expect(response.headers.get('Location')).toBe('https://example.com/__clerk/v1/oauth/callback?code=123');
 });

 it('does not rewrite Location header for external redirects', async () => {
 const mockResponse = new Response(null, {
 status: 302,
Expand Down

36 changes: 34 additions & 2 deletions
packages/backend/src/proxy.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -27,6 +27,11 @@ export interface FrontendApiProxyOptions {
 * The Clerk secret key. Falls back to CLERK_SECRET_KEY env var.
 */
 secretKey?: string;
 /**
 * The Clerk Frontend API URL. Falls back to the CLERK_FAPI_URL environment variable.
 * If not provided, the URL is derived from the publishable key.
 */
 fapiUrl?: string;
}

/**
Expand DownExpand Up@@ -111,6 +116,20 @@ export function stripTrailingSlashes(str: string): string {
 return str;
}

function normalizeFapiUrl(fapiUrl: string): string {
 const url = new URL(fapiUrl);

 if (url.protocol !== 'http:' && url.protocol !== 'https:') {
 throw new Error('FAPI URL must use http or https');
 }

 if (url.username || url.password || url.search || url.hash) {
 throw new Error('FAPI URL must not include credentials, a query string, or a hash');
 }

 return stripTrailingSlashes(url.toString());
}

/**
 * Checks if a request path matches the proxy path.
 * @param request - The incoming request
Expand DownExpand Up@@ -233,10 +252,23 @@ export async function clerkFrontendApiProxy(request: Request, options?: Frontend
 );
 }

 // Derive the FAPI URL and construct the target URL.
 // Resolve the FAPI URL and construct the target URL.
 // Use string concatenation instead of `new URL(path, base)` to avoid
 // protocol-relative resolution (e.g., "//evil.com" resolving to a different host).
 const fapiBaseUrl = fapiUrlFromPublishableKey(publishableKey);
 let fapiBaseUrl: string;
 try {
 fapiBaseUrl = normalizeFapiUrl(
 options?.fapiUrl ||
 (typeof process !== 'undefined' ? process.env?.CLERK_FAPI_URL : undefined) ||
 fapiUrlFromPublishableKey(publishableKey),
 );
 } catch (error) {
 return createErrorResponse(
 'proxy_configuration_error',
 error instanceof Error ? error.message : 'Invalid FAPI URL',
 500,
 );
 }
 const fapiHost = new URL(fapiBaseUrl).host;
 const targetPath = requestUrl.pathname.slice(proxyPath.length) || '/';
 const targetUrl = new URL(`${fapiBaseUrl}${targetPath}`);
Expand Down

31 changes: 31 additions & 0 deletions
packages/nextjs/src/server/__tests__/proxy.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';

import { createFrontendApiProxyHandlers } from '../proxy';

describe('createFrontendApiProxyHandlers', () => {
 const mockFetch = vi.fn();
 const originalFetch = global.fetch;

 beforeEach(() => {
 global.fetch = mockFetch;
 mockFetch.mockReset();
 });

 afterEach(() => {
 global.fetch = originalFetch;
 });

 it('forwards fapiUrl to the backend proxy', async () => {
 mockFetch.mockResolvedValue(new Response(JSON.stringify({ client: {} }), { status: 200 }));
 const request = new Request('https://example.com/__clerk/v1/client');
 const handlers = createFrontendApiProxyHandlers({
 publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
 secretKey: 'sk_test_xxx',
 fapiUrl: 'http://localhost:8001',
 });

 await handlers.GET(request);

 expect(mockFetch.mock.calls[0][0]).toBe('http://localhost:8001/v1/client');
 });
});

1 change: 1 addition & 0 deletions
packages/nextjs/src/server/proxy.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -52,6 +52,7 @@ export async function clerkFrontendApiProxy(
 proxyPath: options?.proxyPath || DEFAULT_PROXY_PATH,
 publishableKey: options?.publishableKey || PUBLISHABLE_KEY,
 secretKey: options?.secretKey || SECRET_KEY,
 fapiUrl: options?.fapiUrl,
 });
}

Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(backend): support configurable Frontend API proxy URLs#9223

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

thiskevinwang
merged 1 commit into

from

Jul 23, 2026
 Merged


feat(backend): support configurable Frontend API proxy URLs
#9223
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


6 changes: 6 additions & 0 deletions
.changeset/bright-pandas-proxy.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
---
"@clerk/backend": minor
"@clerk/nextjs": minor
---

Add an `fapiUrl` option to Frontend API proxy helpers so requests can target a custom Clerk Frontend API URL.

99 changes: 99 additions & 0 deletions
packages/backend/src/__tests__/proxy.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -83,14 +83,21 @@ describe('proxy', () => {
 describe('clerkFrontendApiProxy', () => {
 const mockFetch = vi.fn();
 const originalFetch = global.fetch;
 const originalFapiUrl = process.env.CLERK_FAPI_URL;

 beforeEach(() => {
 global.fetch = mockFetch;
 mockFetch.mockReset();
 delete process.env.CLERK_FAPI_URL;
 });

 afterEach(() => {
 global.fetch = originalFetch;
 if (originalFapiUrl === undefined) {
 delete process.env.CLERK_FAPI_URL;
 } else {
 process.env.CLERK_FAPI_URL = originalFapiUrl;
 }
 });

 it('returns error when publishableKey is missing', async () => {
Expand DownExpand Up@@ -197,6 +204,77 @@ describe('proxy', () => {
 expect(response.status).toBe(200);
 });

 it('uses the configured FAPI URL over CLERK_FAPI_URL and the publishable key', async () => {
 process.env.CLERK_FAPI_URL = 'https://frontend-api.clerkstage.dev';
 mockFetch.mockResolvedValue(new Response(JSON.stringify({ client: {} }), { status: 200 }));

 const request = new Request('https://example.com/__clerk/v1/client');

 await clerkFrontendApiProxy(request, {
 publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
 secretKey: 'sk_test_xxx',
 fapiUrl: 'http://localhost:8001/',
 });

 const [url, options] = mockFetch.mock.calls[0];
 expect(url).toBe('http://localhost:8001/v1/client');
 expect(options.headers.get('Host')).toBe('localhost:8001');
 });

Comment on lines

+207
 to 
+222

@coderabbitaicoderabbitaiBotJul 23, 2026

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Document the new public fapiUrl option.
The linked Next.js middleware options table and delegated proxy-properties partial do not expose fapiUrl, leaving the new supported configuration undiscoverable. Update those docs alongside this API addition. As per coding guidelines, “Update documentation for API changes.”
🧰 Tools
🪛 Betterleaks (1.6.1)
[high] 214-214: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/backend/src/__tests__/proxy.test.ts` around lines 207 - 222, Update
the public Next.js middleware options documentation and delegated
proxy-properties partial to include the new fapiUrl option, describing its
purpose and configuration behavior consistently with clerkFrontendApiProxy and
its existing options. Ensure the option appears in both documented locations so
the supported API is discoverable.

Sources: Coding guidelines, Linked repositories

 it('uses CLERK_FAPI_URL when no FAPI URL is configured', async () => {
 process.env.CLERK_FAPI_URL = 'https://frontend-api.clerkstage.dev';
 mockFetch.mockResolvedValue(new Response(JSON.stringify({ client: {} }), { status: 200 }));

 const request = new Request('https://example.com/__clerk/v1/client');

 await clerkFrontendApiProxy(request, {
 publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
 secretKey: 'sk_test_xxx',
 });

 expect(mockFetch.mock.calls[0][0]).toBe('https://frontend-api.clerkstage.dev/v1/client');
 });

Comment on lines

+224
 to 
+236

@coderabbitaicoderabbitaiBotJul 23, 2026

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Cover trailing-slash normalization for CLERK_FAPI_URL.
This only verifies an environment URL without a trailing slash. Use https://frontend-api.clerkstage.dev/ here and retain the no-double-slash assertion, so the environment fallback contract is protected independently of the direct fapiUrl path.
🧰 Tools
🪛 Betterleaks (1.6.1)
[high] 231-231: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/backend/src/__tests__/proxy.test.ts` around lines 224 - 236, Update
the test “uses CLERK_FAPI_URL when no FAPI URL is configured” to set
CLERK_FAPI_URL with a trailing slash, while retaining the expected fetch URL
without a double slash. Keep the test focused on the environment fallback path
and leave the direct fapiUrl behavior unchanged.

Source: Coding guidelines

 it.each([
 ['unsupported scheme', 'ftp://frontend-api.clerk.dev', undefined, 'FAPI URL must use http or https'],
 [
 'credentials',
 'https://user:password@frontend-api.clerk.dev',
 undefined,
 'FAPI URL must not include credentials, a query string, or a hash',
 ],
 [
 'query string',
 'https://frontend-api.clerk.dev?env=staging',
 undefined,
 'FAPI URL must not include credentials, a query string, or a hash',
 ],
 [
 'fragment',
 'https://frontend-api.clerk.dev#staging',
 undefined,
 'FAPI URL must not include credentials, a query string, or a hash',
 ],
 ['invalid environment value', undefined, 'not-a-url', 'Invalid URL'],
 ])('returns a configuration error for an invalid FAPI URL with %s', async (_case, fapiUrl, envFapiUrl, message) => {
 if (envFapiUrl) {
 process.env.CLERK_FAPI_URL = envFapiUrl;
 }
 const request = new Request('https://example.com/__clerk/v1/client');

 const response = await clerkFrontendApiProxy(request, {
 publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
 secretKey: 'sk_test_xxx',
 ...(fapiUrl ? { fapiUrl } : {}),
 });

 expect(response.status).toBe(500);
 expect(mockFetch).not.toHaveBeenCalled();
 await expect(response.json()).resolves.toMatchObject({
 errors: [{ code: 'proxy_configuration_error', message }],
 });
 });

 it('forwards POST request with body', async () => {
 const mockResponse = new Response(JSON.stringify({ success: true }), {
 status: 200,
Expand DownExpand Up@@ -477,6 +555,27 @@ describe('proxy', () => {
 expect(response.headers.get('Location')).toBe('https://example.com/__clerk/v1/oauth/callback?code=123');
 });

 it('rewrites redirects from a configured FAPI URL', async () => {
 const mockResponse = new Response(null, {
 status: 302,
 headers: {
 Location: 'http://localhost:8001/v1/oauth/callback?code=123',
 },
 });
 mockFetch.mockResolvedValue(mockResponse);

 const request = new Request('https://example.com/__clerk/v1/oauth/authorize');

 const response = await clerkFrontendApiProxy(request, {
 publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
 secretKey: 'sk_test_xxx',
 fapiUrl: 'http://localhost:8001',
 });

 expect(response.status).toBe(302);
 expect(response.headers.get('Location')).toBe('https://example.com/__clerk/v1/oauth/callback?code=123');
 });

 it('does not rewrite Location header for external redirects', async () => {
 const mockResponse = new Response(null, {
 status: 302,
Expand Down

36 changes: 34 additions & 2 deletions
packages/backend/src/proxy.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -27,6 +27,11 @@ export interface FrontendApiProxyOptions {
 * The Clerk secret key. Falls back to CLERK_SECRET_KEY env var.
 */
 secretKey?: string;
 /**
 * The Clerk Frontend API URL. Falls back to the CLERK_FAPI_URL environment variable.
 * If not provided, the URL is derived from the publishable key.
 */
 fapiUrl?: string;
}

/**
Expand DownExpand Up@@ -111,6 +116,20 @@ export function stripTrailingSlashes(str: string): string {
 return str;
}

function normalizeFapiUrl(fapiUrl: string): string {
 const url = new URL(fapiUrl);

 if (url.protocol !== 'http:' && url.protocol !== 'https:') {
 throw new Error('FAPI URL must use http or https');
 }

 if (url.username || url.password || url.search || url.hash) {
 throw new Error('FAPI URL must not include credentials, a query string, or a hash');
 }

 return stripTrailingSlashes(url.toString());
}

/**
 * Checks if a request path matches the proxy path.
 * @param request - The incoming request
Expand DownExpand Up@@ -233,10 +252,23 @@ export async function clerkFrontendApiProxy(request: Request, options?: Frontend
 );
 }

 // Derive the FAPI URL and construct the target URL.
 // Resolve the FAPI URL and construct the target URL.
 // Use string concatenation instead of `new URL(path, base)` to avoid
 // protocol-relative resolution (e.g., "//evil.com" resolving to a different host).
 const fapiBaseUrl = fapiUrlFromPublishableKey(publishableKey);
 let fapiBaseUrl: string;
 try {
 fapiBaseUrl = normalizeFapiUrl(
 options?.fapiUrl ||
 (typeof process !== 'undefined' ? process.env?.CLERK_FAPI_URL : undefined) ||
 fapiUrlFromPublishableKey(publishableKey),
 );
 } catch (error) {
 return createErrorResponse(
 'proxy_configuration_error',
 error instanceof Error ? error.message : 'Invalid FAPI URL',
 500,
 );
 }
 const fapiHost = new URL(fapiBaseUrl).host;
 const targetPath = requestUrl.pathname.slice(proxyPath.length) || '/';
 const targetUrl = new URL(`${fapiBaseUrl}${targetPath}`);
Expand Down

31 changes: 31 additions & 0 deletions
packages/nextjs/src/server/__tests__/proxy.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';

import { createFrontendApiProxyHandlers } from '../proxy';

describe('createFrontendApiProxyHandlers', () => {
 const mockFetch = vi.fn();
 const originalFetch = global.fetch;

 beforeEach(() => {
 global.fetch = mockFetch;
 mockFetch.mockReset();
 });

 afterEach(() => {
 global.fetch = originalFetch;
 });

 it('forwards fapiUrl to the backend proxy', async () => {
 mockFetch.mockResolvedValue(new Response(JSON.stringify({ client: {} }), { status: 200 }));
 const request = new Request('https://example.com/__clerk/v1/client');
 const handlers = createFrontendApiProxyHandlers({
 publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
 secretKey: 'sk_test_xxx',
 fapiUrl: 'http://localhost:8001',
 });

 await handlers.GET(request);

 expect(mockFetch.mock.calls[0][0]).toBe('http://localhost:8001/v1/client');
 });
});

1 change: 1 addition & 0 deletions
packages/nextjs/src/server/proxy.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -52,6 +52,7 @@ export async function clerkFrontendApiProxy(
 proxyPath: options?.proxyPath || DEFAULT_PROXY_PATH,
 publishableKey: options?.publishableKey || PUBLISHABLE_KEY,
 secretKey: options?.secretKey || SECRET_KEY,
 fapiUrl: options?.fapiUrl,
 });
}

Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(backend): support configurable Frontend API proxy URLs#9223

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

thiskevinwang
merged 1 commit into

from

Jul 23, 2026
 Merged


feat(backend): support configurable Frontend API proxy URLs
#9223
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


6 changes: 6 additions & 0 deletions
.changeset/bright-pandas-proxy.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
---
"@clerk/backend": minor
"@clerk/nextjs": minor
---

Add an `fapiUrl` option to Frontend API proxy helpers so requests can target a custom Clerk Frontend API URL.

99 changes: 99 additions & 0 deletions
packages/backend/src/__tests__/proxy.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -83,14 +83,21 @@ describe('proxy', () => {
 describe('clerkFrontendApiProxy', () => {
 const mockFetch = vi.fn();
 const originalFetch = global.fetch;
 const originalFapiUrl = process.env.CLERK_FAPI_URL;

 beforeEach(() => {
 global.fetch = mockFetch;
 mockFetch.mockReset();
 delete process.env.CLERK_FAPI_URL;
 });

 afterEach(() => {
 global.fetch = originalFetch;
 if (originalFapiUrl === undefined) {
 delete process.env.CLERK_FAPI_URL;
 } else {
 process.env.CLERK_FAPI_URL = originalFapiUrl;
 }
 });

 it('returns error when publishableKey is missing', async () => {
Expand DownExpand Up@@ -197,6 +204,77 @@ describe('proxy', () => {
 expect(response.status).toBe(200);
 });

 it('uses the configured FAPI URL over CLERK_FAPI_URL and the publishable key', async () => {
 process.env.CLERK_FAPI_URL = 'https://frontend-api.clerkstage.dev';
 mockFetch.mockResolvedValue(new Response(JSON.stringify({ client: {} }), { status: 200 }));

 const request = new Request('https://example.com/__clerk/v1/client');

 await clerkFrontendApiProxy(request, {
 publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
 secretKey: 'sk_test_xxx',
 fapiUrl: 'http://localhost:8001/',
 });

 const [url, options] = mockFetch.mock.calls[0];
 expect(url).toBe('http://localhost:8001/v1/client');
 expect(options.headers.get('Host')).toBe('localhost:8001');
 });

Comment on lines

+207
 to 
+222

@coderabbitaicoderabbitaiBotJul 23, 2026

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Document the new public fapiUrl option.
The linked Next.js middleware options table and delegated proxy-properties partial do not expose fapiUrl, leaving the new supported configuration undiscoverable. Update those docs alongside this API addition. As per coding guidelines, “Update documentation for API changes.”
🧰 Tools
🪛 Betterleaks (1.6.1)
[high] 214-214: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/backend/src/__tests__/proxy.test.ts` around lines 207 - 222, Update
the public Next.js middleware options documentation and delegated
proxy-properties partial to include the new fapiUrl option, describing its
purpose and configuration behavior consistently with clerkFrontendApiProxy and
its existing options. Ensure the option appears in both documented locations so
the supported API is discoverable.

Sources: Coding guidelines, Linked repositories

 it('uses CLERK_FAPI_URL when no FAPI URL is configured', async () => {
 process.env.CLERK_FAPI_URL = 'https://frontend-api.clerkstage.dev';
 mockFetch.mockResolvedValue(new Response(JSON.stringify({ client: {} }), { status: 200 }));

 const request = new Request('https://example.com/__clerk/v1/client');

 await clerkFrontendApiProxy(request, {
 publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
 secretKey: 'sk_test_xxx',
 });

 expect(mockFetch.mock.calls[0][0]).toBe('https://frontend-api.clerkstage.dev/v1/client');
 });

Comment on lines

+224
 to 
+236

@coderabbitaicoderabbitaiBotJul 23, 2026

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Cover trailing-slash normalization for CLERK_FAPI_URL.
This only verifies an environment URL without a trailing slash. Use https://frontend-api.clerkstage.dev/ here and retain the no-double-slash assertion, so the environment fallback contract is protected independently of the direct fapiUrl path.
🧰 Tools
🪛 Betterleaks (1.6.1)
[high] 231-231: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/backend/src/__tests__/proxy.test.ts` around lines 224 - 236, Update
the test “uses CLERK_FAPI_URL when no FAPI URL is configured” to set
CLERK_FAPI_URL with a trailing slash, while retaining the expected fetch URL
without a double slash. Keep the test focused on the environment fallback path
and leave the direct fapiUrl behavior unchanged.

Source: Coding guidelines

 it.each([
 ['unsupported scheme', 'ftp://frontend-api.clerk.dev', undefined, 'FAPI URL must use http or https'],
 [
 'credentials',
 'https://user:password@frontend-api.clerk.dev',
 undefined,
 'FAPI URL must not include credentials, a query string, or a hash',
 ],
 [
 'query string',
 'https://frontend-api.clerk.dev?env=staging',
 undefined,
 'FAPI URL must not include credentials, a query string, or a hash',
 ],
 [
 'fragment',
 'https://frontend-api.clerk.dev#staging',
 undefined,
 'FAPI URL must not include credentials, a query string, or a hash',
 ],
 ['invalid environment value', undefined, 'not-a-url', 'Invalid URL'],
 ])('returns a configuration error for an invalid FAPI URL with %s', async (_case, fapiUrl, envFapiUrl, message) => {
 if (envFapiUrl) {
 process.env.CLERK_FAPI_URL = envFapiUrl;
 }
 const request = new Request('https://example.com/__clerk/v1/client');

 const response = await clerkFrontendApiProxy(request, {
 publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
 secretKey: 'sk_test_xxx',
 ...(fapiUrl ? { fapiUrl } : {}),
 });

 expect(response.status).toBe(500);
 expect(mockFetch).not.toHaveBeenCalled();
 await expect(response.json()).resolves.toMatchObject({
 errors: [{ code: 'proxy_configuration_error', message }],
 });
 });

 it('forwards POST request with body', async () => {
 const mockResponse = new Response(JSON.stringify({ success: true }), {
 status: 200,
Expand DownExpand Up@@ -477,6 +555,27 @@ describe('proxy', () => {
 expect(response.headers.get('Location')).toBe('https://example.com/__clerk/v1/oauth/callback?code=123');
 });

 it('rewrites redirects from a configured FAPI URL', async () => {
 const mockResponse = new Response(null, {
 status: 302,
 headers: {
 Location: 'http://localhost:8001/v1/oauth/callback?code=123',
 },
 });
 mockFetch.mockResolvedValue(mockResponse);

 const request = new Request('https://example.com/__clerk/v1/oauth/authorize');

 const response = await clerkFrontendApiProxy(request, {
 publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
 secretKey: 'sk_test_xxx',
 fapiUrl: 'http://localhost:8001',
 });

 expect(response.status).toBe(302);
 expect(response.headers.get('Location')).toBe('https://example.com/__clerk/v1/oauth/callback?code=123');
 });

 it('does not rewrite Location header for external redirects', async () => {
 const mockResponse = new Response(null, {
 status: 302,
Expand Down

36 changes: 34 additions & 2 deletions
packages/backend/src/proxy.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -27,6 +27,11 @@ export interface FrontendApiProxyOptions {
 * The Clerk secret key. Falls back to CLERK_SECRET_KEY env var.
 */
 secretKey?: string;
 /**
 * The Clerk Frontend API URL. Falls back to the CLERK_FAPI_URL environment variable.
 * If not provided, the URL is derived from the publishable key.
 */
 fapiUrl?: string;
}

/**
Expand DownExpand Up@@ -111,6 +116,20 @@ export function stripTrailingSlashes(str: string): string {
 return str;
}

function normalizeFapiUrl(fapiUrl: string): string {
 const url = new URL(fapiUrl);

 if (url.protocol !== 'http:' && url.protocol !== 'https:') {
 throw new Error('FAPI URL must use http or https');
 }

 if (url.username || url.password || url.search || url.hash) {
 throw new Error('FAPI URL must not include credentials, a query string, or a hash');
 }

 return stripTrailingSlashes(url.toString());
}

/**
 * Checks if a request path matches the proxy path.
 * @param request - The incoming request
Expand DownExpand Up@@ -233,10 +252,23 @@ export async function clerkFrontendApiProxy(request: Request, options?: Frontend
 );
 }

 // Derive the FAPI URL and construct the target URL.
 // Resolve the FAPI URL and construct the target URL.
 // Use string concatenation instead of `new URL(path, base)` to avoid
 // protocol-relative resolution (e.g., "//evil.com" resolving to a different host).
 const fapiBaseUrl = fapiUrlFromPublishableKey(publishableKey);
 let fapiBaseUrl: string;
 try {
 fapiBaseUrl = normalizeFapiUrl(
 options?.fapiUrl ||
 (typeof process !== 'undefined' ? process.env?.CLERK_FAPI_URL : undefined) ||
 fapiUrlFromPublishableKey(publishableKey),
 );
 } catch (error) {
 return createErrorResponse(
 'proxy_configuration_error',
 error instanceof Error ? error.message : 'Invalid FAPI URL',
 500,
 );
 }
 const fapiHost = new URL(fapiBaseUrl).host;
 const targetPath = requestUrl.pathname.slice(proxyPath.length) || '/';
 const targetUrl = new URL(`${fapiBaseUrl}${targetPath}`);
Expand Down

31 changes: 31 additions & 0 deletions
packages/nextjs/src/server/__tests__/proxy.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';

import { createFrontendApiProxyHandlers } from '../proxy';

describe('createFrontendApiProxyHandlers', () => {
 const mockFetch = vi.fn();
 const originalFetch = global.fetch;

 beforeEach(() => {
 global.fetch = mockFetch;
 mockFetch.mockReset();
 });

 afterEach(() => {
 global.fetch = originalFetch;
 });

 it('forwards fapiUrl to the backend proxy', async () => {
 mockFetch.mockResolvedValue(new Response(JSON.stringify({ client: {} }), { status: 200 }));
 const request = new Request('https://example.com/__clerk/v1/client');
 const handlers = createFrontendApiProxyHandlers({
 publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
 secretKey: 'sk_test_xxx',
 fapiUrl: 'http://localhost:8001',
 });

 await handlers.GET(request);

 expect(mockFetch.mock.calls[0][0]).toBe('http://localhost:8001/v1/client');
 });
});

1 change: 1 addition & 0 deletions
packages/nextjs/src/server/proxy.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -52,6 +52,7 @@ export async function clerkFrontendApiProxy(
 proxyPath: options?.proxyPath || DEFAULT_PROXY_PATH,
 publishableKey: options?.publishableKey || PUBLISHABLE_KEY,
 secretKey: options?.secretKey || SECRET_KEY,
 fapiUrl: options?.fapiUrl,
 });
}

Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
feat(backend): support configurable Frontend API proxy URLs#9223

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

thiskevinwang
merged 1 commit into

from

Jul 23, 2026
 Merged


feat(backend): support configurable Frontend API proxy URLs
#9223
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


6 changes: 6 additions & 0 deletions
.changeset/bright-pandas-proxy.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
---
"@clerk/backend": minor
"@clerk/nextjs": minor
---

Add an `fapiUrl` option to Frontend API proxy helpers so requests can target a custom Clerk Frontend API URL.

99 changes: 99 additions & 0 deletions
packages/backend/src/__tests__/proxy.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -83,14 +83,21 @@ describe('proxy', () => {
 describe('clerkFrontendApiProxy', () => {
 const mockFetch = vi.fn();
 const originalFetch = global.fetch;
 const originalFapiUrl = process.env.CLERK_FAPI_URL;

 beforeEach(() => {
 global.fetch = mockFetch;
 mockFetch.mockReset();
 delete process.env.CLERK_FAPI_URL;
 });

 afterEach(() => {
 global.fetch = originalFetch;
 if (originalFapiUrl === undefined) {
 delete process.env.CLERK_FAPI_URL;
 } else {
 process.env.CLERK_FAPI_URL = originalFapiUrl;
 }
 });

 it('returns error when publishableKey is missing', async () => {
Expand DownExpand Up@@ -197,6 +204,77 @@ describe('proxy', () => {
 expect(response.status).toBe(200);
 });

 it('uses the configured FAPI URL over CLERK_FAPI_URL and the publishable key', async () => {
 process.env.CLERK_FAPI_URL = 'https://frontend-api.clerkstage.dev';
 mockFetch.mockResolvedValue(new Response(JSON.stringify({ client: {} }), { status: 200 }));

 const request = new Request('https://example.com/__clerk/v1/client');

 await clerkFrontendApiProxy(request, {
 publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
 secretKey: 'sk_test_xxx',
 fapiUrl: 'http://localhost:8001/',
 });

 const [url, options] = mockFetch.mock.calls[0];
 expect(url).toBe('http://localhost:8001/v1/client');
 expect(options.headers.get('Host')).toBe('localhost:8001');
 });

Comment on lines

+207
 to 
+222

@coderabbitaicoderabbitaiBotJul 23, 2026

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Document the new public fapiUrl option.
The linked Next.js middleware options table and delegated proxy-properties partial do not expose fapiUrl, leaving the new supported configuration undiscoverable. Update those docs alongside this API addition. As per coding guidelines, “Update documentation for API changes.”
🧰 Tools
🪛 Betterleaks (1.6.1)
[high] 214-214: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/backend/src/__tests__/proxy.test.ts` around lines 207 - 222, Update
the public Next.js middleware options documentation and delegated
proxy-properties partial to include the new fapiUrl option, describing its
purpose and configuration behavior consistently with clerkFrontendApiProxy and
its existing options. Ensure the option appears in both documented locations so
the supported API is discoverable.

Sources: Coding guidelines, Linked repositories

 it('uses CLERK_FAPI_URL when no FAPI URL is configured', async () => {
 process.env.CLERK_FAPI_URL = 'https://frontend-api.clerkstage.dev';
 mockFetch.mockResolvedValue(new Response(JSON.stringify({ client: {} }), { status: 200 }));

 const request = new Request('https://example.com/__clerk/v1/client');

 await clerkFrontendApiProxy(request, {
 publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
 secretKey: 'sk_test_xxx',
 });

 expect(mockFetch.mock.calls[0][0]).toBe('https://frontend-api.clerkstage.dev/v1/client');
 });

Comment on lines

+224
 to 
+236

@coderabbitaicoderabbitaiBotJul 23, 2026

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Cover trailing-slash normalization for CLERK_FAPI_URL.
This only verifies an environment URL without a trailing slash. Use https://frontend-api.clerkstage.dev/ here and retain the no-double-slash assertion, so the environment fallback contract is protected independently of the direct fapiUrl path.
🧰 Tools
🪛 Betterleaks (1.6.1)
[high] 231-231: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/backend/src/__tests__/proxy.test.ts` around lines 224 - 236, Update
the test “uses CLERK_FAPI_URL when no FAPI URL is configured” to set
CLERK_FAPI_URL with a trailing slash, while retaining the expected fetch URL
without a double slash. Keep the test focused on the environment fallback path
and leave the direct fapiUrl behavior unchanged.

Source: Coding guidelines

 it.each([
 ['unsupported scheme', 'ftp://frontend-api.clerk.dev', undefined, 'FAPI URL must use http or https'],
 [
 'credentials',
 'https://user:password@frontend-api.clerk.dev',
 undefined,
 'FAPI URL must not include credentials, a query string, or a hash',
 ],
 [
 'query string',
 'https://frontend-api.clerk.dev?env=staging',
 undefined,
 'FAPI URL must not include credentials, a query string, or a hash',
 ],
 [
 'fragment',
 'https://frontend-api.clerk.dev#staging',
 undefined,
 'FAPI URL must not include credentials, a query string, or a hash',
 ],
 ['invalid environment value', undefined, 'not-a-url', 'Invalid URL'],
 ])('returns a configuration error for an invalid FAPI URL with %s', async (_case, fapiUrl, envFapiUrl, message) => {
 if (envFapiUrl) {
 process.env.CLERK_FAPI_URL = envFapiUrl;
 }
 const request = new Request('https://example.com/__clerk/v1/client');

 const response = await clerkFrontendApiProxy(request, {
 publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
 secretKey: 'sk_test_xxx',
 ...(fapiUrl ? { fapiUrl } : {}),
 });

 expect(response.status).toBe(500);
 expect(mockFetch).not.toHaveBeenCalled();
 await expect(response.json()).resolves.toMatchObject({
 errors: [{ code: 'proxy_configuration_error', message }],
 });
 });

 it('forwards POST request with body', async () => {
 const mockResponse = new Response(JSON.stringify({ success: true }), {
 status: 200,
Expand DownExpand Up@@ -477,6 +555,27 @@ describe('proxy', () => {
 expect(response.headers.get('Location')).toBe('https://example.com/__clerk/v1/oauth/callback?code=123');
 });

 it('rewrites redirects from a configured FAPI URL', async () => {
 const mockResponse = new Response(null, {
 status: 302,
 headers: {
 Location: 'http://localhost:8001/v1/oauth/callback?code=123',
 },
 });
 mockFetch.mockResolvedValue(mockResponse);

 const request = new Request('https://example.com/__clerk/v1/oauth/authorize');

 const response = await clerkFrontendApiProxy(request, {
 publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
 secretKey: 'sk_test_xxx',
 fapiUrl: 'http://localhost:8001',
 });

 expect(response.status).toBe(302);
 expect(response.headers.get('Location')).toBe('https://example.com/__clerk/v1/oauth/callback?code=123');
 });

 it('does not rewrite Location header for external redirects', async () => {
 const mockResponse = new Response(null, {
 status: 302,
Expand Down

36 changes: 34 additions & 2 deletions
packages/backend/src/proxy.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -27,6 +27,11 @@ export interface FrontendApiProxyOptions {
 * The Clerk secret key. Falls back to CLERK_SECRET_KEY env var.
 */
 secretKey?: string;
 /**
 * The Clerk Frontend API URL. Falls back to the CLERK_FAPI_URL environment variable.
 * If not provided, the URL is derived from the publishable key.
 */
 fapiUrl?: string;
}

/**
Expand DownExpand Up@@ -111,6 +116,20 @@ export function stripTrailingSlashes(str: string): string {
 return str;
}

function normalizeFapiUrl(fapiUrl: string): string {
 const url = new URL(fapiUrl);

 if (url.protocol !== 'http:' && url.protocol !== 'https:') {
 throw new Error('FAPI URL must use http or https');
 }

 if (url.username || url.password || url.search || url.hash) {
 throw new Error('FAPI URL must not include credentials, a query string, or a hash');
 }

 return stripTrailingSlashes(url.toString());
}

/**
 * Checks if a request path matches the proxy path.
 * @param request - The incoming request
Expand DownExpand Up@@ -233,10 +252,23 @@ export async function clerkFrontendApiProxy(request: Request, options?: Frontend
 );
 }

 // Derive the FAPI URL and construct the target URL.
 // Resolve the FAPI URL and construct the target URL.
 // Use string concatenation instead of `new URL(path, base)` to avoid
 // protocol-relative resolution (e.g., "//evil.com" resolving to a different host).
 const fapiBaseUrl = fapiUrlFromPublishableKey(publishableKey);
 let fapiBaseUrl: string;
 try {
 fapiBaseUrl = normalizeFapiUrl(
 options?.fapiUrl ||
 (typeof process !== 'undefined' ? process.env?.CLERK_FAPI_URL : undefined) ||
 fapiUrlFromPublishableKey(publishableKey),
 );
 } catch (error) {
 return createErrorResponse(
 'proxy_configuration_error',
 error instanceof Error ? error.message : 'Invalid FAPI URL',
 500,
 );
 }
 const fapiHost = new URL(fapiBaseUrl).host;
 const targetPath = requestUrl.pathname.slice(proxyPath.length) || '/';
 const targetUrl = new URL(`${fapiBaseUrl}${targetPath}`);
Expand Down

31 changes: 31 additions & 0 deletions
packages/nextjs/src/server/__tests__/proxy.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';

import { createFrontendApiProxyHandlers } from '../proxy';

describe('createFrontendApiProxyHandlers', () => {
 const mockFetch = vi.fn();
 const originalFetch = global.fetch;

 beforeEach(() => {
 global.fetch = mockFetch;
 mockFetch.mockReset();
 });

 afterEach(() => {
 global.fetch = originalFetch;
 });

 it('forwards fapiUrl to the backend proxy', async () => {
 mockFetch.mockResolvedValue(new Response(JSON.stringify({ client: {} }), { status: 200 }));
 const request = new Request('https://example.com/__clerk/v1/client');
 const handlers = createFrontendApiProxyHandlers({
 publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
 secretKey: 'sk_test_xxx',
 fapiUrl: 'http://localhost:8001',
 });

 await handlers.GET(request);

 expect(mockFetch.mock.calls[0][0]).toBe('http://localhost:8001/v1/client');
 });
});

1 change: 1 addition & 0 deletions
packages/nextjs/src/server/proxy.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -52,6 +52,7 @@ export async function clerkFrontendApiProxy(
 proxyPath: options?.proxyPath || DEFAULT_PROXY_PATH,
 publishableKey: options?.publishableKey || PUBLISHABLE_KEY,
 secretKey: options?.secretKey || SECRET_KEY,
 fapiUrl: options?.fapiUrl,
 });
}

Expand Down
Loading