Current state
As of Sep 6, 2026Clerk offers four core plans—Hobby (free), Pro ($20/mo billed annually or $25/mo monthly), Business ($250/mo billed annually or $300/mo monthly), and custom-priced Enterprise—all supporting unlimited applications, with usage-based overages for Monthly Retained Users (MRUs), Enterprise connections, and Machine Authentication. Optional add-ons cover enhanced B2B Authentication, Administration (impersonation), and usage-based Billing (0.7% of billing volume plus Stripe fees).
| Plan | Price | Includes |
|---|---|---|
| Hobby | $0 / month | Up to 3 dashboard seats · 50,000 MRU limit per app · Up to 5 user impersonations · Fixed, 7 day session lifetime · Application Logs: 1 day retention |
| Pro | $20 / month | 50,000 MRU included per app; additional $0.02/mo each · 1 Enterprise connection included; additional $75/mo each · Remove Clerk branding · Multi-factor authentication (MFA) · Application Logs: 7 day retention |
| Business | $250 / month | 10 dashboard seats included; additional $20/mo each · SOC2 Report · Enhanced dashboard roles · Priority support · Application and Admin Logs: 30 day retention |
| Enterprise | — | Annual committed use discounts · 99.99% Uptime SLA · Enterprise SSO for workspace · Premium support SLA + dedicated slack channel · HIPAA compliance available with BAA |
Free tier Hobby plan is free, no credit card required: up to 3 dashboard seats, unlimited applications, 50,000 MRU limit per app, up to 5 user impersonations, custom domain, fixed 7 day session lifetime, 1 day log retention.
Changes
- ChangePricing
Added 'Biometric sign-in' feature to pricing comparison table as a new included feature in higher tiers.
Authenticate with any form of passkeys. Not includedIncludedIncluded Custom password requirementsAuthenticate with any form of passkeys. Not includedIncludedIncluded Biometric sign-in Let returning users sign in to native apps with their device's biometrics. Not includedIncludedIncluded Custom password requirementsConfidence95% - ChangePricing
Clerk renamed 'Application Logs' to 'Application and Admin Logs' in Pro and Enterprise plans, and added a new 'Admin Logs' feature with 30-day retention in Enterprise tier.
* Application Logs 30 day retention ENTERPRISE ... * Application Logs Custom retention * Log sink destinations* Application and Admin Logs 30 day retention ENTERPRISE ... * Application and Admin Logs Custom retention * Log sink destinations ... Admin Logs An audit trail of workspace admin actions — instance configuration changes, role and permission edits, secret rotations, and other Dashboard-initiated operations. Not includedNot included30 day retentionSupport & complianceConfidence95% - ChangePricing
HIPAA compliance clarified as not included on Hobby/Pro/Business plans, with a new note that HIPAA BAA is only available on the Enterprise plan.
HIPAA compliance Not includedNot includedIncludedHIPAA compliance HIPAA Business Associate Agreement (BAA) available on the Enterprise plan. Not includedNot includedNot includedConfidence90%
This is the Competitor pricing pack running on a real vendor.
Current state
As of Aug 29, 2026Clerk's changelog for late August 2026 covers configurable reverification windows, new Admin Logs for audit trails, custom OAuth scopes for MCP clients, biometric sign-in for mobile SDKs, discounts/promo codes in Billing, and beta support for Client ID Metadata Documents (CIMD) in OAuth.
Latest entries
- Customize reverification window duration for sensitive actionsaddition
- Admin Logs added to the Clerk Dashboard for audit trail trackingaddition
- Define custom OAuth scopes for MCP clientsaddition
- Mobile SDKs support biometric device enrollment and sign-inaddition
- Billing now supports discounts and promo codesaddition
- OAuth provider supports Client ID Metadata Documents in betaaddition
Changes
- ChangeAPI changelog
Added new reverification window customization feature (Aug 28) and removed Google Workspace Directory Sync announcement (Aug 5).
Aug 5 Directory Sync now supports Google Workspace. Clerk connects directly to your Workspace directory and syncs users, groups, and group memberships. Clerk pulls the directory with a Google service account and computes changes, keeping your user base current without waiting for sign-in events. SET UP Open a Google SAML connection in the Clerk Dashboard and select the Directory sync tab. Upload a service account key with domain-wide delegation, along with the Workspace admin it should impersonate. Clerk validates the credentials against your directory before enabling Directory Sync. If you disable it later, Clerk keeps the stored credentials so you can re-enable it with one click. WORKS WITH ROLE MAPPING AND CUSTOM ATTRIBUTES Google groups sync automatically and can be mapped to Clerk Roles. Custom attribute mapping supports the full pulled directory record, including standard fields such as organizations.title and Workspace custom schemas such as customSchemas.EmployeeInfo.costCenter. Map array paths to a multi-valued attribute to sync all items. See the Directory Sync docs for the full setup guide.Aug 28 You can now customize how long a successful sign-in or reverification remains valid for Clerk-protected sensitive actions. Set the reverification window between 1 and 10 minutes. The default remains 10 minutes. A shorter window can prompt users to verify their credentials more often before actions such as changing a password, adding and removing an email address, revoking a session, or deleting an account. To configure the window, open the Sessions page in the Clerk Dashboard. Under Session lifetime, set Reverification window to the number of minutes you want, between 1 and 10. This setting applies to sensitive actions protected by Clerk. For sensitive actions unique to your application, define the required window in your application. See the reverification guide for details.Confidence75% - ChangeAPI changelog
Clerk renamed 'trusted device' APIs to 'biometric credential' APIs across mobile SDKs (Expo, iOS, Android), and removed Aug 4 changelog entry about strict user enumeration protection.
import { useTrustedDevices } from '@clerk/expo' const { enroll } = useTrustedDevices() await revoke(trustedDeviceId) try await Clerk.shared.trustedDevices.enroll() try await Clerk.shared.auth.signInWithTrustedDevice() Clerk.trustedDevices.enroll() Clerk.auth.signInWithTrustedDevice() Clerk.trustedDevices.revoke(trustedDeviceId)import { useBiometricCredentials } from '@clerk/expo' const { enroll } = useBiometricCredentials() await revoke(biometricCredentialId) try await Clerk.shared.biometricCredentials.enroll() try await Clerk.shared.auth.signInWithBiometrics() Clerk.biometricCredentials.enroll() Clerk.auth.signInWithBiometrics() Clerk.biometricCredentials.revoke(biometricCredentialId)Confidence95% - ChangeAPI changelog
New OAuth scopes feature added (Aug 21); Jul 31 self-serve OIDC SSO entry removed from changelog.
Jul 31 Your customers can now set up their own OIDC connections. Self-serve SSO lets you delegate enterprise SSO configuration to your customers' IT admins, without giving them Dashboard access. In addition to SAML, it now supports custom OpenID Connect (OIDC) providers. Note Self-serve SSO is only available for applications using Clerk Organizations. HOW IT WORKS The Security tab in <OrganizationProfile /> now has an OpenID Connect (OIDC) group in the provider picker, alongside SAML. An admin with the org:sys_entconns:manage permission selects OIDC Provider and sets up the connection end-to-end: * Domains: Add one or more domains and verify ownership of each with a DNS TXT record. * Connection: Create an OIDC application in the identity provider using the authorized redirect URI Clerk displays, then supply the provider's endpoints — a discovery endpoint, or the authorization, token, and user info URLs — along with the client ID and client secret. Clerk reads sub and email from the ID token, and given_name and family_name when the provider sends them. * Test: Run a test sign-in to confirm the connection works end-to-end. * Activate: Turn the connection on once the test passes. The connection is scoped to the Organization it's configured in and behaves like any other enterprise connection once it's live: users with a matching email domain sign in through the configured provider. GET STARTED Self-serve SSO is enabled per Organization. In the Clerk Dashboard, select an Organization, open its Settings, and turn on Allow this organization to set up enterprise SSO under Organization permissions. The Security tab then surfaces wherever your app renders <OrganizationProfile />. For setup details and requirements, refer to the self-serve SSO documentation.Aug 21 Clerk now gives you finer control over the access that MCP clients can request from your API. Define custom OAuth scopes in the Clerk Dashboard to match the actions and resources your API supports. For example: * messages:read * tools:execute * resources/files:read * mcp_all Assign only the scopes that each OAuth application needs. Separately, choose which scopes to advertise through Clerk's OAuth metadata so MCP clients can discover what your application supports. Open the Scopes tab on the OAuth applications page to get started. To enforce scopes in your API, verify each OAuth access token and check its granted scopes. See Verify OAuth tokens with Clerk.Confidence85%
This is the Product and API pack running on a real vendor.
Watch Clerk — or anything else — your way.
Your own prompt, cadence and channels. One alert with the before/after proof when your sentence comes true.