Struct ClerkAuthLayer 

pub struct ClerkAuthLayer { /* private fields */ }

Available on crate feature server only.

Tower layer that verifies Clerk session JWTs and inserts a VerificationOutcome into request extensions. Valid bearer tokens (or __session cookies) produce VerificationOutcome::Valid(auth). The layer is non-rejecting for missing or invalid credentials: it records the outcome and lets the request continue so downstream code can decide how to handle anonymous requests.

Restricting accepted tokens

With the default configuration, any JWT signed by your Clerk instance key verifies, including tokens minted from Clerk JWT templates for third-party integrations, which legitimately reach browsers. If your instance uses JWT templates, configure ClerkAuthLayerConfig::with_issuers and ClerkAuthLayerConfig::with_authorized_parties (and audiences where applicable) via ClerkAuthLayer::from_config so integration tokens cannot pass as session tokens.

Verification model and limitations

Verification is stateless: each request is checked purely against the cached JWKS signing keys, with no call back to Clerk to consult live session state. Two consequences follow, both inherent to networkless JWT verification and matching Clerk’s own backend model:

• No revocation window. A token whose session has since been signed out or revoked stays accepted until its exp. Clerk session tokens are short-lived (about a minute), so the exposure is bounded by that lifetime rather than by revocation. Gate anything that must react to revocation immediately on a fresh check rather than on a still-valid token.
• Key-rotation lag. A token signed with a kid not in the cached JWKS triggers at most one refresh per unknown-kid refresh interval (5 minutes); within that window an unknown kid is rejected as invalid. Clerk pre-publishes new keys before signing with them, so this affects only rotations faster than the refresh floor, and the floor exists to keep an attacker from forcing unbounded JWKS refetches.

worker feature

With the worker feature (server on wasm), the service future is wrapped in SendWrapper to satisfy Axum’s Send bound. This assumes a single-threaded runtime such as Cloudflare Workers: the future must be polled and dropped on the thread that created it, and doing otherwise panics deterministically.

Implementations

impl ClerkAuthLayer

pub fn new(secret_key: impl Into<String>) -> Result<Self, ClerkError>

Build a layer that verifies tokens against Clerk’s live JWKS using the given backend secret key. The JWKS is fetched lazily on the first valid-looking request and cached in memory.

Uses the default configuration; see the type-level docs on restricting accepted tokens when the Clerk instance mints JWT-template tokens.

pub fn from_env() -> Result<Self, ClerkError>

Build a layer from the conventional CLERK_SECRET_KEY environment variable.

Uses the default configuration; see the type-level docs on restricting accepted tokens when the Clerk instance mints JWT-template tokens.

pub fn from_config(config: ClerkAuthLayerConfig) -> Result<Self, ClerkError>

Build a layer from owned verifier configuration.

Use this when an application needs to override Clerk backend settings or enable optional claim validation.

Trait Implementations

impl Clone for ClerkAuthLayer

fn clone(&self) -> ClerkAuthLayer

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ClerkAuthLayer

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<S> Layer<S> for ClerkAuthLayer

type Service = ClerkAuthService<S>

The wrapped service

fn layer(&self, inner: S) -> Self::Service

Wrap the given service with the middleware, returning a new service that has been decorated with the middleware.