@agentic-passport/clerk

Clerk adapter for @agentic-passport/next. Pre-wires onAgentSignup (creates a Clerk shadow user with canonical metadata) and onAgentSessionMint (mints a sign-in-token URL for the browser handoff).

Most vendors using Clerk for human auth want both. Drop the adapter in, pass clerkClient, done.

Note: This package is re-exported as @agentic-passport/next/clerk. You can install either; they're identical. The dedicated package exists for non-Next.js stacks that still use Clerk.

Install

pnpm add @agentic-passport/clerk

Use

import { agentPassport } from '@agentic-passport/next';
import { clerkAgentProvisioner } from '@agentic-passport/clerk';
import { clerkClient } from '@clerk/nextjs/server';

export const getGate = agentPassport({
  vendorOrigin: 'https://your-vendor.example',
  vendorName: 'your-app',
  trustedIssuers: ['https://issuer.agentpassport.app'],
  scopes: ['your.scope'],
  hooks: clerkAgentProvisioner({
    clerkClient,
    vendorOrigin: 'https://your-vendor.example',
    postBootstrapPath: '/account',          // where the agent's browser lands after sign-in
    onProvisioned: async ({ clerkUserId, identity, ctx }) => {
      // Optional: vendor-specific provisioning (billing, tier assignment, audit)
    },
  }),
});

What it does

• onAgentSignup — calls agentIdentity(ctx) to derive canonical agent fields (externalId, email, name, publicMetadata.agentpassport), then clerkClient.users.createUser() or getUser() if it already exists. Returns a principal with userId + grantedScopes.
• onAgentSessionMint — clerkClient.signInTokens.createSignInToken({ userId }) and returns { bootstrap_url, final_url } for the browser-runtime agent path.

Spec

Wire format.

License

Apache-2.0. Repository