mastra-ai/mastra · error

Clerk JWKS URI, secret key and publishable key are required,

Error message

Clerk JWKS URI, secret key and publishable key are required, please provide them in the options or set the environment variables CLERK_JWKS_URI, CLERK_SECRET_KEY and CLERK_PUBLISHABLE_KEY

What it means

The ClerkAuthProvider constructor requires three credentials — a JWKS URI, a secret key, and a publishable key — to verify Clerk-issued JWTs. Each is resolved from constructor options first, then from the CLERK_JWKS_URI, CLERK_SECRET_KEY and CLERK_PUBLISHABLE_KEY environment variables. If any of the three is missing or empty after both lookups, the constructor throws immediately rather than producing a provider that would fail later on token verification.

Source

Thrown at auth/clerk/src/index.ts:287

  private oauthClientId: string | null;
  private oauthClientSecret: string | null;
  private _redirectUri: string | null;
  private scopes: string[];
  private cookieName: string;
  private cookieMaxAge: number;
  private cookiePassword: string;
  private secureCookies: boolean;
  private ssoEnabled: boolean;

  constructor(options?: MastraAuthClerkOptions) {
    super({ name: options?.name ?? 'clerk' });

    const jwksUri = options?.jwksUri ?? process.env.CLERK_JWKS_URI;
    const secretKey = options?.secretKey ?? process.env.CLERK_SECRET_KEY;
    const publishableKey = options?.publishableKey ?? process.env.CLERK_PUBLISHABLE_KEY;

    if (!jwksUri || !secretKey || !publishableKey) {
      throw new Error(
        'Clerk JWKS URI, secret key and publishable key are required, please provide them in the options or set the environment variables CLERK_JWKS_URI, CLERK_SECRET_KEY and CLERK_PUBLISHABLE_KEY',
      );
    }

    this.jwksUri = jwksUri;
    this.publishableKey = publishableKey;
    this.fapiUrl = deriveFapiUrl(publishableKey);
    this.clerk = createClerkClient({
      secretKey,
      publishableKey,
    });

    // SSO configuration (optional — enables Studio login)
    const oauthClientId = options?.oauthClientId ?? process.env.CLERK_OAUTH_CLIENT_ID;
    const oauthClientSecret = options?.oauthClientSecret ?? process.env.CLERK_OAUTH_CLIENT_SECRET;
    const redirectUri = options?.redirectUri ?? process.env.CLERK_OAUTH_REDIRECT_URI;
    const cookiePassword =
      options?.session?.cookiePassword ??

View on GitHub (pinned to 75dd419e61)

Solutions

1. Set CLERK_JWKS_URI, CLERK_SECRET_KEY and CLERK_PUBLISHABLE_KEY in the runtime environment (all three are required).
2. Or pass all three explicitly: new ClerkAuthProvider({ jwksUri, secretKey, publishableKey }).
3. Copy values from the Clerk dashboard (API Keys section) and verify with a startup check that all three are non-empty before constructing the provider.
4. Ensure the provider is constructed after your env/config loader has run, not at import time.

Example fix

// before
export const provider = new ClerkAuthProvider();
// after
if (!process.env.CLERK_JWKS_URI || !process.env.CLERK_SECRET_KEY || !process.env.CLERK_PUBLISHABLE_KEY) {
  throw new Error('Missing Clerk configuration: set CLERK_JWKS_URI, CLERK_SECRET_KEY, CLERK_PUBLISHABLE_KEY');
}
export const provider = new ClerkAuthProvider();

const required = ['CLERK_JWKS_URI', 'CLERK_SECRET_KEY', 'CLERK_PUBLISHABLE_KEY'] as const;
const missing = required.filter(k => !process.env[k]);
if (missing.length) throw new Error(`Missing Clerk env vars: ${missing.join(', ')}`);
const provider = new ClerkAuthProvider();

When it happens

Trigger: `new ClerkAuthProvider()` (or with partial options) executed in a process where none/only some of CLERK_JWKS_URI, CLERK_SECRET_KEY, CLERK_PUBLISHABLE_KEY are set and the corresponding options fields are undefined.

Common situations: Deploying without copying .env values to the hosting platform; env vars set in one environment (local) but not another (CI/production); a typo'd variable name; secrets loaded asynchronously after the provider is constructed at module scope; missing Clerk API keys entirely for a new project.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

• Cookie password must be at least 32 characters for SSO. Set
• Redirect URI is required for SSO login
• Token exchange failed: ${error}
• Failed to fetch user info from Clerk
• Google client ID is required. Provide it in the options or s

AI-assisted analysis of mastra-ai/mastra@75dd419e61 (2026-08-30). Data as JSON: /api/errors/6e212f464fe41655. Report an issue: GitHub.