{"record":{"id":"6e212f464fe41655","repo":"mastra-ai/mastra","slug":"clerk-jwks-uri-secret-key-and-publishable-key-are","errorCode":null,"errorMessage":"Clerk JWKS URI, secret key and publishable key are required, please provide them in the options or set the environment variables CLERK_JWKS_URI, CLERK_SECRET_KEY and CLERK_PUBLISHABLE_KEY","messagePattern":"Clerk JWKS URI, secret key and publishable key are required, please provide them in the options or set the environment variables CLERK_JWKS_URI, CLERK_SECRET_KEY and CLERK_PUBLISHABLE_KEY","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"auth/clerk/src/index.ts","lineNumber":287,"sourceCode":"  private oauthClientId: string | null;\n  private oauthClientSecret: string | null;\n  private _redirectUri: string | null;\n  private scopes: string[];\n  private cookieName: string;\n  private cookieMaxAge: number;\n  private cookiePassword: string;\n  private secureCookies: boolean;\n  private ssoEnabled: boolean;\n\n  constructor(options?: MastraAuthClerkOptions) {\n    super({ name: options?.name ?? 'clerk' });\n\n    const jwksUri = options?.jwksUri ?? process.env.CLERK_JWKS_URI;\n    const secretKey = options?.secretKey ?? process.env.CLERK_SECRET_KEY;\n    const publishableKey = options?.publishableKey ?? process.env.CLERK_PUBLISHABLE_KEY;\n\n    if (!jwksUri || !secretKey || !publishableKey) {\n      throw new Error(\n        'Clerk JWKS URI, secret key and publishable key are required, please provide them in the options or set the environment variables CLERK_JWKS_URI, CLERK_SECRET_KEY and CLERK_PUBLISHABLE_KEY',\n      );\n    }\n\n    this.jwksUri = jwksUri;\n    this.publishableKey = publishableKey;\n    this.fapiUrl = deriveFapiUrl(publishableKey);\n    this.clerk = createClerkClient({\n      secretKey,\n      publishableKey,\n    });\n\n    // SSO configuration (optional — enables Studio login)\n    const oauthClientId = options?.oauthClientId ?? process.env.CLERK_OAUTH_CLIENT_ID;\n    const oauthClientSecret = options?.oauthClientSecret ?? process.env.CLERK_OAUTH_CLIENT_SECRET;\n    const redirectUri = options?.redirectUri ?? process.env.CLERK_OAUTH_REDIRECT_URI;\n    const cookiePassword =\n      options?.session?.cookiePassword ??","sourceCodeStart":269,"sourceCodeEnd":305,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/auth/clerk/src/index.ts#L269-L305","documentation":"The ClerkAuthProvider constructor requires three credentials — a JWKS URI, a secret key, and a publishable key — to verify Clerk-issued JWTs. Each is resolved from constructor options first, then from the CLERK_JWKS_URI, CLERK_SECRET_KEY and CLERK_PUBLISHABLE_KEY environment variables. If any of the three is missing or empty after both lookups, the constructor throws immediately rather than producing a provider that would fail later on token verification.","triggerScenarios":"`new ClerkAuthProvider()` (or with partial options) executed in a process where none/only some of CLERK_JWKS_URI, CLERK_SECRET_KEY, CLERK_PUBLISHABLE_KEY are set and the corresponding options fields are undefined.","commonSituations":"Deploying without copying .env values to the hosting platform; env vars set in one environment (local) but not another (CI/production); a typo'd variable name; secrets loaded asynchronously after the provider is constructed at module scope; missing Clerk API keys entirely for a new project.","solutions":["Set CLERK_JWKS_URI, CLERK_SECRET_KEY and CLERK_PUBLISHABLE_KEY in the runtime environment (all three are required).","Or pass all three explicitly: new ClerkAuthProvider({ jwksUri, secretKey, publishableKey }).","Copy values from the Clerk dashboard (API Keys section) and verify with a startup check that all three are non-empty before constructing the provider.","Ensure the provider is constructed after your env/config loader has run, not at import time."],"exampleFix":"// before\nexport const provider = new ClerkAuthProvider();\n// after\nif (!process.env.CLERK_JWKS_URI || !process.env.CLERK_SECRET_KEY || !process.env.CLERK_PUBLISHABLE_KEY) {\n  throw new Error('Missing Clerk configuration: set CLERK_JWKS_URI, CLERK_SECRET_KEY, CLERK_PUBLISHABLE_KEY');\n}\nexport const provider = new ClerkAuthProvider();","handlingStrategy":"validation","validationCode":"const required = ['CLERK_JWKS_URI', 'CLERK_SECRET_KEY', 'CLERK_PUBLISHABLE_KEY'] as const;\nconst missing = required.filter(k => !process.env[k]);\nif (missing.length) throw new Error(`Missing Clerk env vars: ${missing.join(', ')}`);\nconst provider = new ClerkAuthProvider();","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate all three env vars at process startup, before constructing the provider.","Keep provider construction after config loading, not at module import time.","Copy env vars into every deploy target (CI, staging, prod) as part of the release checklist."],"tags":["auth","clerk","configuration","env-var"],"backgroundTag":"missing-env-var","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}