Clerk

Clerk Well Known API

Well-known endpoints like JWKS, deep linking, and openid-configuration.

GitHub OpenAPI

Operations 5

GET /.well-known/jwks.json JWKS #
GET /.well-known/apple-app-site-association Apple App Site Association #
GET /.well-known/openid-configuration Basic OpenID Configuration Payload #
GET /.well-known/oauth-authorization-server OAuth 2.0 Authorization Server Metadata #

Documentation

📖
Documentation
https://clerk.com/docs/reference/backend-api
📖
APIReference
https://clerk.com/docs/reference/backend-api
📖
GettingStarted
https://clerk.com/docs/quickstarts/overview
📖
Authentication
https://clerk.com/docs/backend-requests/making/jwt-templates
📖
Documentation
https://clerk.com/docs
📖
Documentation
https://clerk.com/docs/webhooks/overview

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/clerk-com/refs/heads/main/openapi/clerk-com-well-known-api-openapi.yml

Other Resources

🔗
SpectralRuleset
https://raw.githubusercontent.com/api-evangelist/clerk-com/refs/heads/main/rules/clerk-rules.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/clerk-com-well-known-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

clerk-com-well-known-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Clerk Frontend Well Known API
  version: v1
  description: 'The Clerk REST Frontend API, meant to be accessed from a browser or native environment.


    This is a Form Based API and all the data must be sent and formatted according to the `application/x-www-form-urlencoded` content type.


    ### Versions


    When the API changes in a way that isn''t compatible with older versions, a new version is released.

    Each version is identified by its release date, e.g. `2021-02-05`. For more information, please see [Clerk API Versions](https://clerk.com/docs/backend-requests/versioning/overview).


    ### Using the Try It Console


    The `Try It` feature of the docs only works for **Development Instances** when using the `DevBrowser` security scheme.

    To use it, first generate a dev instance token from the `/v1/dev_browser` endpoint.


    Please see https://clerk.com/docs for more information.'
  x-logo:
    url: https://clerk.com/_next/image?url=%2Fimages%2Fclerk-logo.svg&w=96&q=75
    altText: Clerk docs
    href: https://clerk.com/docs
  contact:
    email: support@clerk.com
    name: Clerk Team
    url: https://clerk.com/support
  termsOfService: https://clerk.com/terms
  license:
    name: MIT
    url: https://github.com/clerk/javascript/blob/main/LICENSE
servers:
- url: https://{domain}.clerk.accounts.dev
  variables:
    domain:
      default: example-destined-camel-13
      description: Your Development Instance Frontend API Domain.
security:
- {}
- DevBrowser: []
- ProductionBrowser: []
- ProductionNativeApp: []
  ProductionNativeFlag: []
tags:
- name: Well Known
  description: Well-known endpoints like JWKS, deep linking, and openid-configuration.
paths:
  /.well-known/assetlinks.json:
    get:
      summary: Get Android Asset Links
      description: Get Android asset links for universal/deep linking
      operationId: getAndroidAssetLinks
      security: []
      tags:
      - Well Known
      responses:
        '200':
          $ref: '#/components/responses/WellKnown.Assetlinks'
  /.well-known/jwks.json:
    get:
      summary: JWKS
      description: Retrieve the JSON Web Key Set of the instance
      operationId: getJWKS
      security: []
      tags:
      - Well Known
      responses:
        '200':
          $ref: '#/components/responses/WellKnown.JWKS'
        '500':
          $ref: '#/components/responses/ClerkErrors'
  /.well-known/apple-app-site-association:
    get:
      summary: Apple App Site Association
      description: Retrieve the Apple App Site Association file of the instance
      operationId: getAppleAppSiteAssociation
      security: []
      tags:
      - Well Known
      responses:
        '200':
          $ref: '#/components/responses/WellKnown.AppleAppSiteAssociation'
        '500':
          $ref: '#/components/responses/ClerkErrors'
  /.well-known/openid-configuration:
    get:
      summary: Basic OpenID Configuration Payload
      description: Get a basic OpenID configuration payload
      operationId: getOpenIDConfiguration
      security: []
      tags:
      - Well Known
      responses:
        '200':
          $ref: '#/components/responses/WellKnown.OpenIDConfiguration'
  /.well-known/oauth-authorization-server:
    get:
      summary: OAuth 2.0 Authorization Server Metadata
      description: Get the OAuth 2.0 Authorization Server Metadata according to RFC 8414
      operationId: getOAuth2AuthorizationServerMetadata
      security: []
      tags:
      - Well Known
      responses:
        '200':
          $ref: '#/components/responses/WellKnown.OAuth2AuthorizationServerMetadata'
components:
  responses:
    WellKnown.OAuth2AuthorizationServerMetadata:
      description: Get the OAuth 2.0 Authorization Server Metadata
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/WellKnown.OAuth2AuthorizationServerMetadata'
    ClerkErrors:
      description: Request was not successful
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ClerkErrors'
    WellKnown.JWKS:
      description: Get the JSON Web Key Set
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/JWKS'
    WellKnown.Assetlinks:
      description: Get Android asset links for universal/deep linking
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/WellKnown.Assetlinks'
    WellKnown.AppleAppSiteAssociation:
      description: Get the Apple App Site Association file
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/WellKnown.AppleAppSiteAssociation'
    WellKnown.OpenIDConfiguration:
      description: Get a basic OpenID configuration payload
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/WellKnown.OpenIDConfiguration'
  schemas:
    JWKS.ecdsa.PrivateKey:
      type: object
      properties:
        kid:
          type: string
        alg:
          type: string
        use:
          type: string
        kty:
          type: string
          enum:
          - EC
        crv:
          type: string
        x:
          type: string
        y:
          type: string
        d:
          type: string
        x5c:
          type: array
          items:
            type: string
        x5t:
          type: string
        x5t#S256:
          type: string
        x5u:
          type: string
      required:
      - kid
      - alg
      - use
      - kty
      - crv
      - x
      - y
      - d
    JWKS.ed25519.PublicKey:
      type: object
      properties:
        kid:
          type: string
        alg:
          type: string
        use:
          type: string
        kty:
          type: string
          enum:
          - OKP
        crv:
          type: string
          enum:
          - Ed25519
        x:
          type: string
        x5c:
          type: array
          items:
            type: string
        x5t:
          type: string
        x5t#S256:
          type: string
        x5u:
          type: string
      required:
      - kid
      - alg
      - use
      - kty
      - crv
      - x
    WellKnown.OpenIDConfiguration:
      type: object
      additionalProperties: false
      properties:
        issuer:
          type: string
        authorization_endpoint:
          type: string
        token_endpoint:
          type: string
        revocation_endpoint:
          type: string
        introspection_endpoint:
          type: string
        userinfo_endpoint:
          type: string
        jwks_uri:
          type: string
        scopes_supported:
          type: array
          items:
            type: string
        response_types_supported:
          type: array
          items:
            type: string
        response_modes_supported:
          type: array
          items:
            type: string
        grant_types_supported:
          type: array
          items:
            type: string
        subject_types_supported:
          type: array
          items:
            type: string
        id_token_signing_alg_values_supported:
          type: array
          items:
            type: string
        token_endpoint_auth_methods_supported:
          type: array
          items:
            type: string
        claims_supported:
          type: array
          items:
            type: string
        code_challenge_methods_supported:
          type: array
          items:
            type: string
        backchannel_logout_supported:
          type: boolean
        frontchannel_logout_supported:
          type: boolean
        end_session_endpoint:
          type: string
      required:
      - issuer
      - authorization_endpoint
      - token_endpoint
      - revocation_endpoint
      - introspection_endpoint
      - userinfo_endpoint
      - jwks_uri
      - scopes_supported
      - response_types_supported
      - response_modes_supported
      - grant_types_supported
      - subject_types_supported
      - id_token_signing_alg_values_supported
      - token_endpoint_auth_methods_supported
      - claims_supported
      - code_challenge_methods_supported
      - backchannel_logout_supported
      - frontchannel_logout_supported
    WellKnown.AppleAppSiteAssociation:
      type: object
      additionalProperties: false
      properties:
        webcredentials:
          type: object
          additionalProperties: false
          properties:
            apps:
              type: array
              items:
                type: string
    WellKnown.OAuth2AuthorizationServerMetadata:
      type: object
      additionalProperties: false
      properties:
        issuer:
          type: string
        authorization_endpoint:
          type: string
        token_endpoint:
          type: string
        revocation_endpoint:
          type: string
        jwks_uri:
          type: string
        registration_endpoint:
          type: string
        response_types_supported:
          type: array
          items:
            type: string
        grant_types_supported:
          type: array
          items:
            type: string
        token_endpoint_auth_methods_supported:
          type: array
          items:
            type: string
        scopes_supported:
          type: array
          items:
            type: string
        subject_types_supported:
          type: array
          items:
            type: string
        id_token_signing_alg_values_supported:
          type: array
          items:
            type: string
        claims_supported:
          type: array
          items:
            type: string
        service_documentation:
          type: string
        ui_locales_supported:
          type: array
          items:
            type: string
        op_tos_uri:
          type: string
        code_challenge_methods_supported:
          type: array
          items:
            type: string
      required:
      - issuer
      - authorization_endpoint
      - token_endpoint
      - revocation_endpoint
      - jwks_uri
      - response_types_supported
      - grant_types_supported
      - token_endpoint_auth_methods_supported
      - scopes_supported
      - subject_types_supported
      - id_token_signing_alg_values_supported
      - claims_supported
      - code_challenge_methods_supported
    ClerkErrors:
      type: object
      properties:
        errors:
          type: array
          items:
            $ref: '#/components/schemas/ClerkError'
        meta:
          type: object
        clerk_trace_id:
          type: string
      required:
      - errors
    JWKS.symmetric.Key:
      type: object
      properties:
        kid:
          type: string
        alg:
          type: string
        use:
          type: string
        kty:
          type: string
          enum:
          - oct
        k:
          type: string
        x5c:
          type: array
          items:
            type: string
        x5t:
          type: string
        x5t#S256:
          type: string
        x5u:
          type: string
      required:
      - kid
      - alg
      - use
      - kty
      - k
    JWKS.ed25519.PrivateKey:
      type: object
      properties:
        kid:
          type: string
        alg:
          type: string
        use:
          type: string
        kty:
          type: string
          enum:
          - OKP
        crv:
          type: string
          enum:
          - Ed25519
        x:
          type: string
        d:
          type: string
        x5c:
          type: array
          items:
            type: string
        x5t:
          type: string
        x5t#S256:
          type: string
        x5u:
          type: string
      required:
      - kid
      - alg
      - use
      - kty
      - crv
      - x
      - d
    JWKS.rsa.PublicKey:
      type: object
      properties:
        kid:
          type: string
        alg:
          type: string
        use:
          type: string
        kty:
          type: string
          enum:
          - RSA
        n:
          type: string
        e:
          type: string
        x5c:
          type: array
          items:
            type: string
        x5t:
          type: string
        x5t#S256:
          type: string
        x5u:
          type: string
      required:
      - kid
      - alg
      - use
      - kty
      - n
      - e
    WellKnown.Assetlinks:
      type: array
      additionalProperties: false
      items:
        type: object
        properties:
          relation:
            type: array
            items:
              type: string
              enum:
              - delegate_permission/common.handle_all_urls
              - delegate_permission/common.get_login_creds
          target:
            type: object
            properties:
              namespace:
                type: string
              package_name:
                type: string
              sha256_cert_fingerprints:
                type: array
                items:
                  type: string
    JWKS.ecdsa.PublicKey:
      type: object
      properties:
        kid:
          type: string
        alg:
          type: string
        use:
          type: string
        kty:
          type: string
          enum:
          - EC
        crv:
          type: string
        x:
          type: string
        y:
          type: string
        x5c:
          type: array
          items:
            type: string
        x5t:
          type: string
        x5t#S256:
          type: string
        x5u:
          type: string
      required:
      - kid
      - alg
      - use
      - kty
      - crv
      - x
      - y
    ClerkError:
      type: object
      properties:
        message:
          type: string
        long_message:
          type: string
        code:
          type: string
        meta:
          type: object
      required:
      - message
      - long_message
      - code
    JWKS.rsa.PrivateKey:
      type: object
      properties:
        kid:
          type: string
        alg:
          type: string
        use:
          type: string
        kty:
          type: string
          enum:
          - RSA
        n:
          type: string
        e:
          type: string
        d:
          type: string
        p:
          type: string
        q:
          type: string
        dp:
          type: string
        dq:
          type: string
        qi:
          type: string
        x5c:
          type: array
          items:
            type: string
        x5t:
          type: string
        x5t#S256:
          type: string
        x5u:
          type: string
      required:
      - kid
      - alg
      - use
      - kty
      - crv
      - n
      - e
      - d
      - p
      - q
    JWKS:
      type: object
      additionalProperties: false
      properties:
        keys:
          type: array
          items:
            oneOf:
            - $ref: '#/components/schemas/JWKS.ed25519.PublicKey'
            - $ref: '#/components/schemas/JWKS.ecdsa.PublicKey'
            - $ref: '#/components/schemas/JWKS.rsa.PublicKey'
            - $ref: '#/components/schemas/JWKS.ed25519.PrivateKey'
            - $ref: '#/components/schemas/JWKS.ecdsa.PrivateKey'
            - $ref: '#/components/schemas/JWKS.rsa.PrivateKey'
            - $ref: '#/components/schemas/JWKS.symmetric.Key'
  securitySchemes:
    ProductionBrowser:
      type: apiKey
      in: cookie
      name: __client
      description: 'The Client API token sent in the form of a browser cookie.


        Used to authenticate production browser applications.'
    DevBrowser:
      type: apiKey
      in: query
      name: __dev_session
      description: 'A Dev Browser API token sent as a query parameter.


        Used to authenticate only dev instances.


        To generate a dev instance API token you must first make a request to `/v1/dev_browser`

        and copy it from the response.'
    ProductionNativeApp:
      type: http
      scheme: bearer
      description: 'The Client API token sent in the `Authorization` header.


        Used to authenticate native applications.'
    ProductionNativeFlag:
      type: apiKey
      in: query
      name: _is_native
      description: 'If sent and the value is true, it instructs the server to parse the API token from the `Authorization` header.


        It should always be set to true when using the `Authorization` header authentication strategy.'
    ClientCredentials:
      type: http
      scheme: basic
      description: HTTP Basic Authentication using Client ID as username and Client Secret as password.
x-tagGroups:
- name: Environment
  tags:
  - Environment
- name: Client
  tags:
  - Client
  - Sessions
  - Sign Ins
  - Sign Ups
- name: User
  tags:
  - User
  - Active Sessions
  - Email Addresses
  - Phone Numbers
  - Web3 Wallets
  - Passkeys
  - External Accounts
  - TOTP
  - Backup Codes
  - Organizations Memberships
  - API Keys
- name: Organizations
  tags:
  - Organization
  - Organization Creation Defaults
  - Invitations
  - Membership Requests
  - Members
  - Domains
  - Roles
- name: Billing
  tags:
  - Plans
  - Subscriptions
  - Subscription Items
  - Checkouts
  - Payment Methods
  - Statements
  - Payment Attempts
- name: Other
  tags:
  - Well Known
  - DevBrowser
  - DevTools
  - Health
  - OAuth2 Identity Provider
  - OAuth2 Callbacks
  - SAML
  - Waitlist
  - Enterprise Connections