Clerk setup skill: add Clerk auth with a coding agent

Source: clerk/skills · Maintainer: Clerk · License: MIT (per README, SKILL.md and plugin.json; no LICENSE file) · Checked: 28 October 2026

What is the Clerk setup skill?

The Clerk setup skill teaches a coding agent to add Clerk authentication to a project using the Clerk CLI and Clerk's own framework quickstarts. It covers four starting points: an existing app without Clerk, an empty folder, an app that already uses Clerk, and an app on a different auth provider. It is for developers who want an agent to add sign-in with Clerk's own CLI and quickstarts instead of guessing at SDK versions.

The skill lives in clerk/skills, the official repo Clerk describes in its README as "Skills to help AI coding agents work more effectively with Clerk." Its description reads: "Set up Clerk authentication in any project with the Clerk CLI and official framework quickstarts. Use when adding Clerk, initializing Clerk, scaffolding a new app with Clerk, or migrating an existing authentication system to Clerk."

The frontmatter lists version 2.6.0, author clerk, and one allowed tool, WebFetch, which it uses to read Clerk's docs. Its compatibility note says current Clerk SDKs need Node.js 20.9.0 or later. As of 28 October 2026, its skills.sh page listed about 57,000 installs (snapshot, 28 October 2026), the most of the 22 clerk/skills entries listed there.

What does it do?

The folder is small: SKILL.md plus evals/evals.json, a set of test prompts and expected outcomes (for example, "Adds ClerkProvider to root layout.tsx inside tag, not wrapping "). Everything the agent needs is in the SKILL.md, which links out to Clerk's docs for each framework.

It asks first. Before doing anything, the agent shows a three-step checklist (set up Clerk or scaffold an app, install Clerk's agent skills, start the app) and waits for a yes.

It checks what's already there. The agent inspects auth dependencies, routes, middleware, sessions and user records, "never environment files." If another provider exists, it stops and asks for approval of a migration plan that covers user import, stable external IDs, password hashes, OAuth continuity, protected routes and session cutover. If the project already uses Clerk, it skips init so it can't create a second application, and keeps the project's SDK generation. A short list maps Core 2 differences, such as <SignedIn> and <SignedOut> instead of <Show>.

It runs the Clerk CLI. For a project without Clerk, the main command is:

npx -y clerk@latest init

The skill says init detects the framework and package manager, installs the SDK, and configures the provider, middleware, auth routes and environment. It also installs Clerk's agent skills globally; the skill adds --no-skills when they're already loaded. In an empty folder it asks for a framework and package manager (default Next.js and npm) and init creates the app in a new subdirectory. Clerk's CLI docs describe the same command.

It handles keys without accounts. On Next.js, React Router, Astro, Nuxt and TanStack Start, a signed-out run provisions a claimable application and writes temporary development keys. The agent relays the claim instruction and doesn't sign in for you.

It falls back to docs. If init can't detect the framework or leaves steps undone, the agent follows the matching quickstart. The skill links 14 of them, from Next.js to Chrome extensions, and points to Clerk's llms.txt for anything else.

It finishes the job. The agent adds sign-in, sign-up and user controls to your layout, runs npx -y clerk@latest doctor, and starts the app. If components.json exists, it adds @clerk/ui and the shadcn theme. After setup it walks you through claiming the app, choosing sign-in methods with clerk config pull and config patch, running clerk deploy before production, and optionally enabling Organizations.

The critical rules include: await auth() on Next.js 15 and later, ClerkProvider inside <body>, wrap auth-reading Server Components in <Suspense> when cacheComponents is on, and never expose CLERK_SECRET_KEY in client code.

How do you install the Clerk setup skill?

The repo README lists several routes. Pick one per agent so you don't load the same skills twice.

Just this skill. The command on skills.sh uses the skills CLI:

npx skills add https://github.com/clerk/skills --skill clerk-setup

Add -g to make it available across projects. Claude Code reads skills from .claude/skills/ in a project or ~/.claude/skills/ for all projects, per the Claude Code skills docs.

All Clerk skills. npx skills add clerk/skills installs the whole set into any agent.

Claude Code plugin. The clerk plugin bundles every skill plus the Clerk MCP server:

/plugin marketplace add clerk/skills
/plugin install clerk@clerk-skills

The README says to enable auto-update for the clerk-skills marketplace in /plugin to get updates.

Codex, Cursor and Copilot CLI. For Codex, run codex plugin marketplace add clerk/skills, then codex plugin add clerk@clerk. For Cursor, run cursor-agent plugin marketplace add https://github.com/clerk/skills and install clerk from /plugin. For GitHub Copilot CLI, add the marketplace and run copilot plugin install clerk@clerk-skills. See Codex skills and Cursor skills.

How do you use it?

Ask in plain words. The skill is model-invoked, so "add Clerk" or "set up auth with Clerk" can load it, or you can type /clerk-setup. The README's own example is "Add Clerk auth to my Next.js app."

Example prompts (suggestions, not quotes from the repo):

• Add Clerk auth to this Next.js app. Use accountless keys for now.
• This folder is empty. Scaffold a React Router app with Clerk and pnpm.
• We use NextAuth today. Plan a migration to Clerk, but don't change anything yet.
• Link this project to my existing Clerk app instead of creating a new one.
• Clerk is installed but the sign-in page 404s. Add whatever is missing.

For the existing-app prompt, expect the agent to ask you to run npx -y clerk@latest auth login in your own terminal, then show your applications and let you pick. The skill says, "Never choose an application for them."

Tips and limits

From the repo, Clerk's docs and skills.sh, not from testing:

• It runs commands and installs packages. init installs SDKs and, unless skipped, Clerk's agent skills globally. Read the checklist before you say yes.
• Test users in automated browsers. Bot protection can block sign-ups in a browser the agent drives. For a new accountless app, the skill creates a test user with a +clerk_test@example.com address and uses the code 424242, and tells you it did. For an existing app, it asks first.
• Temporary keys aren't for production. The skill says to claim the app and run clerk deploy first.
• Two claim files can conflict. If both .clerk/keyless.json and .clerk/.tmp/keyless.json exist, the skill stops and has you choose which app the project uses.
• It changes often. The latest commits to the folder are dated 26 October 2026, so re-check it if you keep a copy.
• Security audits. On skills.sh, Snyk rated the skill Warn (medium risk) on 27 October 2026 for third-party content exposure, an indirect prompt injection category, while scoring the risk low (0.10) and noting that the fetched pages are Clerk's own first-party docs. Gen Agent Trust Hub rated it Pass (Safe) on 27 October 2026, noting npm downloads, npx commands, and that it reads project files without explicit sanitization. Socket rated it Pass on 27 October 2026.
• License. The README, the SKILL.md frontmatter and plugin.json all say MIT; the repo has no separate LICENSE file.

Save it in your Kipt library

A copy is useful if your team always starts the same way: one framework, one package manager, a fixed list of sign-in methods. In Kipt, open Skills and paste the skill's GitHub folder link into the import box, or drop the folder or a .zip. For a repo with many skills, Kipt shows a list so you can also take clerk-nextjs-patterns or clerk-orgs. Your skills live in your own private GitHub repo and install into Claude Code or Codex with one command:

npx skills add https://github.com/<you>/<repo>.git --all -g

Kipt is not affiliated with Clerk.

Similar skills

• Better Auth skill: the equivalent for the open-source Better Auth library.
• Convex auth skill: Convex's official skill for sign-in with @convex-dev/auth.
• Firebase auth basics skill: Firebase's official Auth skill.
• Supabase skill: Supabase's official skill, with a security checklist and CLI and MCP gotchas.