clerk-nextjs-patterns by clerk/skills
npx skills add https://github.com/clerk/skills --skill clerk-nextjs-patterns版本:请查看
package.json中的 SDK 版本——版本表请参考clerk技能。Core 2 的差异已通过> **仅限 Core 2(如果当前是 SDK 则跳过):**标注在文中注明。
基础设置请参考 setup/。
| 参考文档 | 影响级别 |
|---|---|
references/server-vs-client.md |
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
严重 - await auth() 与钩子函数 |
references/middleware-strategies.md | 高 - 公共优先与保护优先策略,proxy.ts(Next.js <=15:middleware.ts) |
references/server-actions.md | 高 - 保护数据变更操作 |
references/api-routes.md | 高 - 401 与 403 状态码 |
references/caching-auth.md | 中 - 用户作用域的缓存 |
服务器端与客户端使用不同的身份验证 API:
@clerk/nextjs/server 的 await auth()(异步!)@clerk/nextjs 的 useAuth() 钩子函数(同步)切勿混合使用。服务器组件使用服务器端导入,客户端组件使用钩子函数。
来自 auth() 的关键属性:
isAuthenticated — 布尔值,用于替代 !!userId 模式sessionStatus — 'active' | 'pending',用于检测未完成的会话任务userId, orgId, orgSlug, has(), protect() — 保持不变仅限 Core 2(如果当前是 SDK 则跳过):
isAuthenticated和sessionStatus不可用。请改用!!userId进行检查。
// 服务器组件
import { auth } from '@clerk/nextjs/server'
export default async function Page() {
const { isAuthenticated, userId } = await auth() // 必须使用 await!
if (!isAuthenticated) return <p>未登录</p>
return <p>你好 {userId}</p>
}
仅限 Core 2(如果当前是 SDK 则跳过):
isAuthenticated不可用。请改用if (!userId)。
<Show> 进行条件渲染用于基于身份验证状态的客户端条件渲染:
import { Show } from '@clerk/nextjs'
<Show when="signed-in" fallback={<p>请登录</p>}>
<Dashboard />
</Show>
仅限 Core 2(如果当前是 SDK 则跳过): 请使用
<SignedIn>和<SignedOut>组件代替<Show>。完整的迁移表格请参考custom-ui/core-3/show-component.md。
| 症状 | 原因 | 修复方法 |
|---|---|---|
服务器组件中 userId 为 undefined | 缺少 await | 使用 await auth() 而非 auth() |
| API 路由上的身份验证不工作 | 缺少匹配器 | 在 '/(api 中添加 |
| 缓存返回错误用户的数据 | 缓存键中缺少 userId | 在 unstable_cache 键中包含 userId |
| 数据变更操作绕过身份验证 | 未受保护的服务器操作 | 在操作开始时检查 auth() |
| HTTP 错误代码不正确 | 混淆了 401/403 | 401 = 未登录,403 = 无权限 |
setup/orgs/每周安装量
3.3K
代码仓库
GitHub 星标数
22
首次出现
2026年1月30日
安全审计
安装于
cursor2.8K
codex1.8K
opencode1.8K
gemini-cli1.7K
github-copilot1.7K
amp1.6K
Version : Check
package.jsonfor the SDK version — seeclerkskill for the version table. Core 2 differences are noted inline with> **Core 2 ONLY (skip if current SDK):**callouts.
For basic setup, see setup/.
| Reference | Impact |
|---|---|
references/server-vs-client.md | CRITICAL - await auth() vs hooks |
references/middleware-strategies.md | HIGH - Public-first vs protected-first, proxy.ts (Next.js <=15: middleware.ts) |
references/server-actions.md | HIGH - Protect mutations |
references/api-routes.md | HIGH - 401 vs 403 |
references/caching-auth.md | MEDIUM - User-scoped caching |
Server vs Client = different auth APIs:
await auth() from @clerk/nextjs/server (async!)useAuth() hook from @clerk/nextjs (sync)Never mix them. Server Components use server imports, Client Components use hooks.
Key properties from auth():
isAuthenticated — boolean, replaces the !!userId patternsessionStatus — 'active' | 'pending', for detecting incomplete session tasksuserId, orgId, orgSlug, has(), protect() — unchangedCore 2 ONLY (skip if current SDK):
isAuthenticatedandsessionStatusare not available. Check!!userIdinstead.
// Server Component
import { auth } from '@clerk/nextjs/server'
export default async function Page() {
const { isAuthenticated, userId } = await auth() // MUST await!
if (!isAuthenticated) return <p>Not signed in</p>
return <p>Hello {userId}</p>
}
Core 2 ONLY (skip if current SDK):
isAuthenticatedis not available. Useif (!userId)instead.
<Show>For client-side conditional rendering based on auth state:
import { Show } from '@clerk/nextjs'
<Show when="signed-in" fallback={<p>Please sign in</p>}>
<Dashboard />
</Show>
Core 2 ONLY (skip if current SDK): Use
<SignedIn>and<SignedOut>components instead of<Show>. Seecustom-ui/core-3/show-component.mdfor the full migration table.
| Symptom | Cause | Fix |
|---|---|---|
undefined userId in Server Component | Missing await | await auth() not auth() |
| Auth not working on API routes | Missing matcher | Add `'/(api |
| Cache returns wrong user's data | Missing userId in key | Include userId in unstable_cache key |
| Mutations bypass auth | Unprotected Server Action |
setup/orgs/Weekly Installs
3.3K
Repository
GitHub Stars
22
First Seen
Jan 30, 2026
Security Audits
Gen Agent Trust HubPassSocketPassSnykPass
Installed on
cursor2.8K
codex1.8K
opencode1.8K
gemini-cli1.7K
github-copilot1.7K
amp1.6K
97,600 周安装
Check auth() at start of action |
| Wrong HTTP error code | Confused 401/403 | 401 = not signed in, 403 = no permission |