Struct ClerkAuthLayerConfig 

pub struct ClerkAuthLayerConfig { /* private fields */ }

Available on crate feature server only.

Configuration for crate::server::ClerkAuthLayer.

Security: default claim acceptance

By default (with no issuers, audiences, or authorized parties configured) verification accepts any RS256 JWT that is signed by your instance’s JWKS and passes standard exp/nbf validation. The iss, aud, and azp claims are not checked.

This is safe for the common single-instance case: the JWKS endpoint is scoped to your Clerk instance by the secret key, so a token that verifies against it was necessarily minted by your instance. It is not a bypass.

Security: session tokens only, by default

Verification accepts only Clerk session tokens by default: a token must carry a sid (session id) claim. Clerk JWT-template tokens (minted with getToken({ template }) for third-party integrations) are signed by the same instance JWKS and carry a sub, but omit sid, so without this check a leaked template token could be replayed to authenticate as its user. Requiring sid rejects them while accepting every genuine session token. Opt out with allow_non_session_tokens only if you deliberately verify non-session Clerk JWTs here.

The claim checks below are further defense-in-depth for setups where the single-instance assumption is weaker: multiple apps or environments sharing an instance, satellite domains, or tokens minted for a different audience that you do not want one service to accept for another. For those, harden verification:

• add_authorized_party: restrict the azp origins that may present tokens (Clerk’s recommended check; tokens without azp are still accepted, matching Clerk’s guidance).
• add_issuer: pin the instance frontend origin.
• add_audience: require a specific aud when you mint audience-scoped tokens.

Implementations

impl ClerkAuthLayerConfig

pub fn new(secret_key: impl Into<String>) -> Self

Creates a config using Clerk’s default Backend API base URL.

pub fn from_env() -> Result<Self, ClerkError>

Creates a config from the conventional CLERK_SECRET_KEY environment variable.

pub fn with_backend_api_base_url(self, url: impl Into<String>) -> Self

Sets the HTTPS Clerk Backend API base URL, including API version.

For example: https://api.clerk.com/v1. The JWKS endpoint is derived by appending /jwks to this base URL.

pub fn with_insecure_backend_api_base_url(self, url: impl Into<String>) -> Self

Sets a local/test-only HTTP Backend API base URL.

This explicitly allows http:// URLs for local JWKS mocks. Do not use it in production; plain HTTP allows JWKS response tampering.

pub fn with_static_jwks(self, jwks_json: impl Into<String>) -> Self

Verifies against a fixed JWKS instead of fetching one from Clerk.

jwks_json is a JWKS document ({"keys": [...]}). When set, the Backend API base URL is never contacted: there is no HTTP client, no cache, and no refresh, so the secret key is unused and may be empty.

This is the offline path for tests — pair it with TestIssuer to verify locally minted tokens without standing up a JWKS mock server at all.

It is also usable in production to pin signing keys, but note that a fixed keyset does not rotate: when Clerk rotates its signing keys, every token signed by a new key is rejected until the configured JWKS is updated and the process restarts. Prefer the fetched default unless you have a specific reason to pin.

pub fn add_authorized_party(self, party: impl Into<String>) -> Self

Adds a single allowed azp authorized-party origin to the configured set.

pub fn with_authorized_parties( self, parties: impl IntoIterator<Item = impl Into<String>>, ) -> Self

Sets allowed azp authorized-party origins.

When configured, a token with an azp claim must match one of these values. Tokens without azp continue to be accepted, matching Clerk’s manual verification guidance.

pub fn add_audience(self, audience: impl Into<String>) -> Self

Adds a single allowed JWT audience to the configured set.

pub fn with_audiences( self, audiences: impl IntoIterator<Item = impl Into<String>>, ) -> Self

Sets allowed JWT audiences.

pub fn add_issuer(self, issuer: impl Into<String>) -> Self

Adds a single allowed JWT issuer to the configured set.

Clerk session tokens carry the instance frontend origin as iss (for example https://your-app.clerk.accounts.dev). When configured, tokens whose iss claim is missing or does not match are rejected.

pub fn with_issuers( self, issuers: impl IntoIterator<Item = impl Into<String>>, ) -> Self

Sets allowed JWT issuers.

pub fn with_clock_skew(self, clock_skew: Duration) -> Self

Sets accepted clock skew for JWT exp, nbf, and iat validation.

pub fn allow_non_session_tokens(self) -> Self

Accept instance-signed JWTs that are not session tokens (tokens without a sid claim, such as Clerk JWT-template tokens).

By default verification requires a sid so a leaked JWT-template token cannot be replayed as a session (see the type-level security note). Call this only when you deliberately verify non-session Clerk JWTs here, and pair it with add_audience to keep tokens from one template being accepted for another.

Trait Implementations

impl Clone for ClerkAuthLayerConfig

fn clone(&self) -> ClerkAuthLayerConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ClerkAuthLayerConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.