Clerk

Clerk Well Known API

Well-known endpoints like JWKS, deep linking, and openid-configuration.

GitHub OpenAPI

Operations 5

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /.well-known/jwks.json Get the instance's JSON Web Key Set · JWKS #
Ask an LLM
“Where do I get the public keys to verify session JWTs?”
“What is the JWKS URL for my instance?”
Tell an agent
Fetch the JWKS for my instance.
Get the public signing keys from jwks.json.
GET /.well-known/apple-app-site-association Get the Apple App Site Association file · Apple App Site Association #
Ask an LLM
“Where is the apple-app-site-association file for iOS universal links?”
“How do I confirm my domain serves the AASA file for my iOS app?”
Tell an agent
Fetch the Apple App Site Association file.
Show the iOS universal links association for my instance.
GET /.well-known/openid-configuration Get the OpenID Connect discovery document · Basic OpenID Configuration Payload #
Ask an LLM
“Where is the OpenID configuration discovery document for my instance?”
“Which issuer and endpoints does the openid-configuration advertise?”
Tell an agent
Fetch the OpenID configuration.
Show the OIDC discovery document.
GET /.well-known/oauth-authorization-server Get OAuth 2.0 authorization server metadata · OAuth 2.0 Authorization Server Metadata #
Ask an LLM
“Does the instance publish RFC 8414 authorization server metadata?”
“Where can an OAuth client discover the token and authorize endpoints per RFC 8414?”
Tell an agent
Fetch the OAuth authorization server metadata.
Show the oauth-authorization-server well-known document.

Documentation

📖
Documentation
https://clerk.com/docs/reference/backend-api
📖
APIReference
https://clerk.com/docs/reference/backend-api
📖
GettingStarted
https://clerk.com/docs/quickstarts/overview
📖
Authentication
https://clerk.com/docs/backend-requests/making/jwt-templates
📖
Documentation
https://clerk.com/docs
📖
Documentation
https://clerk.com/docs/webhooks/overview

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/clerk-com/refs/heads/main/openapi/clerk-com-well-known-api-openapi.yml

Other Resources

🔗
SpectralRuleset
https://raw.githubusercontent.com/api-evangelist/clerk-com/refs/heads/main/rules/clerk-rules.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/clerk-com:clerk-com-well-known-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

clerk-com-well-known-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Clerk Frontend Well Known API
  version: v1
  description: The Clerk REST Frontend API, meant to be accessed from a browser or native environment.
  x-logo:
    url: https://clerk.com/_next/image?url=%2Fimages%2Fclerk-logo.svg&w=96&q=75
    altText: Clerk docs
    href: https://clerk.com/docs
  contact:
    email: support@clerk.com
    name: Clerk Team
    url: https://clerk.com/support
  termsOfService: https://clerk.com/terms
  license:
    name: MIT
    url: https://github.com/clerk/javascript/blob/main/LICENSE
servers:
- url: https://{domain}.clerk.accounts.dev
  variables:
    domain:
      default: example-destined-camel-13
      description: Your Development Instance Frontend API Domain.
security:
- {}
- DevBrowser: []
- ProductionBrowser: []
- ProductionNativeApp: []
  ProductionNativeFlag: []
tags:
- name: .well Known
  description: Well-known endpoints like JWKS, deep linking, and openid-configuration.
paths:
  /.well-known/assetlinks.json:
    get:
      summary: Get Android Asset Links
      description: Get Android asset links for universal/deep linking
      operationId: getAndroidAssetLinks
      security: []
      tags:
      - .well Known
      responses:
        '200':
          $ref: '#/components/responses/WellKnown.Assetlinks'
  /.well-known/jwks.json:
    get:
      summary: JWKS
      description: Retrieve the JSON Web Key Set of the instance
      operationId: getJWKS
      security: []
      tags:
      - .well Known
      responses:
        '200':
          $ref: '#/components/responses/WellKnown.JWKS'
        '500':
          $ref: '#/components/responses/ClerkErrors'
  /.well-known/apple-app-site-association:
    get:
      summary: Apple App Site Association
      description: Retrieve the Apple App Site Association file of the instance
      operationId: getAppleAppSiteAssociation
      security: []
      tags:
      - .well Known
      responses:
        '200':
          $ref: '#/components/responses/WellKnown.AppleAppSiteAssociation'
        '500':
          $ref: '#/components/responses/ClerkErrors'
  /.well-known/openid-configuration:
    get:
      summary: Basic OpenID Configuration Payload
      description: Get a basic OpenID configuration payload
      operationId: getOpenIDConfiguration
      security: []
      tags:
      - .well Known
      responses:
        '200':
          $ref: '#/components/responses/WellKnown.OpenIDConfiguration'
  /.well-known/oauth-authorization-server:
    get:
      summary: OAuth 2.0 Authorization Server Metadata
      description: Get the OAuth 2.0 Authorization Server Metadata according to RFC 8414
      operationId: getOAuth2AuthorizationServerMetadata
      security: []
      tags:
      - .well Known
      responses:
        '200':
          $ref: '#/components/responses/WellKnown.OAuth2AuthorizationServerMetadata'
components:
  responses:
    WellKnown.JWKS:
      description: Get the JSON Web Key Set
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/JWKS'
    WellKnown.OpenIDConfiguration:
      description: Get a basic OpenID configuration payload
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/WellKnown.OpenIDConfiguration'
    WellKnown.AppleAppSiteAssociation:
      description: Get the Apple App Site Association file
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/WellKnown.AppleAppSiteAssociation'
    WellKnown.Assetlinks:
      description: Get Android asset links for universal/deep linking
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/WellKnown.Assetlinks'
    ClerkErrors:
      description: Request was not successful
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ClerkErrors'
    WellKnown.OAuth2AuthorizationServerMetadata:
      description: Get the OAuth 2.0 Authorization Server Metadata
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/WellKnown.OAuth2AuthorizationServerMetadata'
  schemas:
    WellKnown.AppleAppSiteAssociation:
      type: object
      additionalProperties: false
      properties:
        webcredentials:
          type: object
          additionalProperties: false
          properties:
            apps:
              type: array
              items:
                type: string
    WellKnown.OpenIDConfiguration:
      type: object
      additionalProperties: false
      properties:
        issuer:
          type: string
        authorization_endpoint:
          type: string
        token_endpoint:
          type: string
        revocation_endpoint:
          type: string
        introspection_endpoint:
          type: string
        userinfo_endpoint:
          type: string
        jwks_uri:
          type: string
        scopes_supported:
          type: array
          items:
            type: string
        response_types_supported:
          type: array
          items:
            type: string
        response_modes_supported:
          type: array
          items:
            type: string
        grant_types_supported:
          type: array
          items:
            type: string
        subject_types_supported:
          type: array
          items:
            type: string
        id_token_signing_alg_values_supported:
          type: array
          items:
            type: string
        token_endpoint_auth_methods_supported:
          type: array
          items:
            type: string
        claims_supported:
          type: array
          items:
            type: string
        code_challenge_methods_supported:
          type: array
          items:
            type: string
        backchannel_logout_supported:
          type: boolean
        frontchannel_logout_supported:
          type: boolean
        end_session_endpoint:
          type: string
      required:
      - issuer
      - authorization_endpoint
      - token_endpoint
      - revocation_endpoint
      - introspection_endpoint
      - userinfo_endpoint
      - jwks_uri
      - scopes_supported
      - response_types_supported
      - response_modes_supported
      - grant_types_supported
      - subject_types_supported
      - id_token_signing_alg_values_supported
      - token_endpoint_auth_methods_supported
      - claims_supported
      - code_challenge_methods_supported
      - backchannel_logout_supported
      - frontchannel_logout_supported
    ClerkError:
      type: object
      properties:
        message:
          type: string
        long_message:
          type: string
        code:
          type: string
        meta:
          type: object
      required:
      - message
      - long_message
      - code
    WellKnown.OAuth2AuthorizationServerMetadata:
      type: object
      additionalProperties: false
      properties:
        issuer:
          type: string
        authorization_endpoint:
          type: string
        token_endpoint:
          type: string
        revocation_endpoint:
          type: string
        jwks_uri:
          type: string
        registration_endpoint:
          type: string
        response_types_supported:
          type: array
          items:
            type: string
        grant_types_supported:
          type: array
          items:
            type: string
        token_endpoint_auth_methods_supported:
          type: array
          items:
            type: string
        scopes_supported:
          type: array
          items:
            type: string
        subject_types_supported:
          type: array
          items:
            type: string
        id_token_signing_alg_values_supported:
          type: array
          items:
            type: string
        claims_supported:
          type: array
          items:
            type: string
        service_documentation:
          type: string
        ui_locales_supported:
          type: array
          items:
            type: string
        op_tos_uri:
          type: string
        code_challenge_methods_supported:
          type: array
          items:
            type: string
      required:
      - issuer
      - authorization_endpoint
      - token_endpoint
      - revocation_endpoint
      - jwks_uri
      - response_types_supported
      - grant_types_supported
      - token_endpoint_auth_methods_supported
      - scopes_supported
      - subject_types_supported
      - id_token_signing_alg_values_supported
      - claims_supported
      - code_challenge_methods_supported
    JWKS.rsa.PrivateKey:
      type: object
      properties:
        kid:
          type: string
        alg:
          type: string
        use:
          type: string
        kty:
          type: string
          enum:
          - RSA
        n:
          type: string
        e:
          type: string
        d:
          type: string
        p:
          type: string
        q:
          type: string
        dp:
          type: string
        dq:
          type: string
        qi:
          type: string
        x5c:
          type: array
          items:
            type: string
        x5t:
          type: string
        x5t#S256:
          type: string
        x5u:
          type: string
      required:
      - kid
      - alg
      - use
      - kty
      - crv
      - n
      - e
      - d
      - p
      - q
    JWKS.ed25519.PublicKey:
      type: object
      properties:
        kid:
          type: string
        alg:
          type: string
        use:
          type: string
        kty:
          type: string
          enum:
          - OKP
        crv:
          type: string
          enum:
          - Ed25519
        x:
          type: string
        x5c:
          type: array
          items:
            type: string
        x5t:
          type: string
        x5t#S256:
          type: string
        x5u:
          type: string
      required:
      - kid
      - alg
      - use
      - kty
      - crv
      - x
    JWKS.ecdsa.PrivateKey:
      type: object
      properties:
        kid:
          type: string
        alg:
          type: string
        use:
          type: string
        kty:
          type: string
          enum:
          - EC
        crv:
          type: string
        x:
          type: string
        y:
          type: string
        d:
          type: string
        x5c:
          type: array
          items:
            type: string
        x5t:
          type: string
        x5t#S256:
          type: string
        x5u:
          type: string
      required:
      - kid
      - alg
      - use
      - kty
      - crv
      - x
      - y
      - d
    JWKS.rsa.PublicKey:
      type: object
      properties:
        kid:
          type: string
        alg:
          type: string
        use:
          type: string
        kty:
          type: string
          enum:
          - RSA
        n:
          type: string
        e:
          type: string
        x5c:
          type: array
          items:
            type: string
        x5t:
          type: string
        x5t#S256:
          type: string
        x5u:
          type: string
      required:
      - kid
      - alg
      - use
      - kty
      - n
      - e
    ClerkErrors:
      type: object
      properties:
        errors:
          type: array
          items:
            $ref: '#/components/schemas/ClerkError'
        meta:
          type: object
        clerk_trace_id:
          type: string
      required:
      - errors
    WellKnown.Assetlinks:
      type: array
      additionalProperties: false
      items:
        type: object
        properties:
          relation:
            type: array
            items:
              type: string
              enum:
              - delegate_permission/common.handle_all_urls
              - delegate_permission/common.get_login_creds
          target:
            type: object
            properties:
              namespace:
                type: string
              package_name:
                type: string
              sha256_cert_fingerprints:
                type: array
                items:
                  type: string
    JWKS.ed25519.PrivateKey:
      type: object
      properties:
        kid:
          type: string
        alg:
          type: string
        use:
          type: string
        kty:
          type: string
          enum:
          - OKP
        crv:
          type: string
          enum:
          - Ed25519
        x:
          type: string
        d:
          type: string
        x5c:
          type: array
          items:
            type: string
        x5t:
          type: string
        x5t#S256:
          type: string
        x5u:
          type: string
      required:
      - kid
      - alg
      - use
      - kty
      - crv
      - x
      - d
    JWKS.ecdsa.PublicKey:
      type: object
      properties:
        kid:
          type: string
        alg:
          type: string
        use:
          type: string
        kty:
          type: string
          enum:
          - EC
        crv:
          type: string
        x:
          type: string
        y:
          type: string
        x5c:
          type: array
          items:
            type: string
        x5t:
          type: string
        x5t#S256:
          type: string
        x5u:
          type: string
      required:
      - kid
      - alg
      - use
      - kty
      - crv
      - x
      - y
    JWKS.symmetric.Key:
      type: object
      properties:
        kid:
          type: string
        alg:
          type: string
        use:
          type: string
        kty:
          type: string
          enum:
          - oct
        k:
          type: string
        x5c:
          type: array
          items:
            type: string
        x5t:
          type: string
        x5t#S256:
          type: string
        x5u:
          type: string
      required:
      - kid
      - alg
      - use
      - kty
      - k
    JWKS:
      type: object
      additionalProperties: false
      properties:
        keys:
          type: array
          items:
            oneOf:
            - $ref: '#/components/schemas/JWKS.ed25519.PublicKey'
            - $ref: '#/components/schemas/JWKS.ecdsa.PublicKey'
            - $ref: '#/components/schemas/JWKS.rsa.PublicKey'
            - $ref: '#/components/schemas/JWKS.ed25519.PrivateKey'
            - $ref: '#/components/schemas/JWKS.ecdsa.PrivateKey'
            - $ref: '#/components/schemas/JWKS.rsa.PrivateKey'
            - $ref: '#/components/schemas/JWKS.symmetric.Key'
  securitySchemes:
    ProductionBrowser:
      type: apiKey
      in: cookie
      name: __client
      description: 'The Client API token sent in the form of a browser cookie.


        Used to authenticate production browser applications.'
    DevBrowser:
      type: apiKey
      in: query
      name: __dev_session
      description: 'A Dev Browser API token sent as a query parameter.


        Used to authenticate only dev instances.


        To generate a dev instance API token you must first make a request to `/v1/dev_browser`

        and copy it from the response.'
    ProductionNativeApp:
      type: http
      scheme: bearer
      description: 'The Client API token sent in the `Authorization` header.


        Used to authenticate native applications.'
    ProductionNativeFlag:
      type: apiKey
      in: query
      name: _is_native
      description: 'If sent and the value is true, it instructs the server to parse the API token from the `Authorization` header.


        It should always be set to true when using the `Authorization` header authentication strategy.'
    ClientCredentials:
      type: http
      scheme: basic
      description: HTTP Basic Authentication using Client ID as username and Client Secret as password.
x-tagGroups:
- name: Environment
  tags:
  - Environment
- name: Client
  tags:
  - Client
  - Sessions
  - Sign Ins
  - Sign Ups
- name: User
  tags:
  - User
  - Active Sessions
  - Email Addresses
  - Phone Numbers
  - Web3 Wallets
  - Passkeys
  - External Accounts
  - TOTP
  - Backup Codes
  - Organizations Memberships
  - API Keys
- name: Organizations
  tags:
  - Organization
  - Organization Creation Defaults
  - Invitations
  - Membership Requests
  - Members
  - Domains
  - Roles
- name: Billing
  tags:
  - Plans
  - Subscriptions
  - Subscription Items
  - Checkouts
  - Payment Methods
  - Statements
  - Payment Attempts
- name: Other
  tags:
  - Well Known
  - DevBrowser
  - DevTools
  - Health
  - OAuth2 Identity Provider
  - OAuth2 Callbacks
  - SAML
  - Waitlist
  - Enterprise Connections