Clerk changed its API changelog

===================================================================
--- before
+++ after
@@ -2,8 +2,25 @@
 
 CLERK CHANGELOG
 
 Subscribe to RSS
+Aug 21
+
+Clerk now gives you finer control over the access that MCP clients can request from your API. Define custom OAuth scopes in the Clerk Dashboard to match the actions and resources your API supports.
+
+For example:
+
+ * messages:read
+ * tools:execute
+ * resources/files:read
+ * mcp_all
+
+Assign only the scopes that each OAuth application needs. Separately, choose which scopes to advertise through Clerk's OAuth metadata so MCP clients can discover what your application supports.
+
+Open the Scopes tab on the OAuth applications⁠ page to get started.
+
+To enforce scopes in your API, verify each OAuth access token and check its granted scopes. See Verify OAuth tokens with Clerk.
+
 Aug 17
 
 Clerk's mobile SDKs can now enroll a signed-in user's current device as a trusted device, then let returning users sign in with Face ID, Touch ID, or Android biometrics. Clerk verifies a device-bound challenge while the private key stays on the device.
 
@@ -78,9 +95,9 @@
 Aug 10
 
 Sometimes the list price isn't the right price. Sales closes a deal with a negotiated discount, you want to reward an early adopter, or you're running a launch promotion. Billing now supports discounts — apply them directly to a customer's subscription, or hand out a promo code customers redeem themselves at checkout.
 
-The Apply discount option on a subscription in the Dashboard [/_next/image?url=%2F_media%2Fchangelog%2F2026-08-10-discounts-and-promo-codes%2Fmanual-discounts.png%3Fhash%3DZ4mcZ0bxiJ6Bs2KRpT8htdJ1p2I07Ddy1nHQC4wnjlI&w=3840&q=75&dpl=dpl_4yszNSNtw5m2DoW4S7fVwtDb4Ntt]
+The Apply discount option on a subscription in the Dashboard [/_next/image?url=%2F_media%2Fchangelog%2F2026-08-10-discounts-and-promo-codes%2Fmanual-discounts.png%3Fhash%3DZ4mcZ0bxiJ6Bs2KRpT8htdJ1p2I07Ddy1nHQC4wnjlI&w=3840&q=75&dpl=dpl_GyCndFGxS1uiUaFxiZTthvNdjfRc]
 
 CREATE A DISCOUNT ONCE, USE IT ANYWHERE
 
 Discounts are reusable and flexible:
@@ -188,30 +205,5 @@
 If you're building your own interface, or you want this behavior without turning strict protection on, the signUpIfMissing option does the same thing in a custom flow. Refer to the sign-in-or-up custom flow guide.
 
 The Account Portal hosts sign-in and sign-up on separate pages, so a sign-in-or-up experience there isn't available under any setting today. General support is on our roadmap. For now, render <SignIn /> in your own app.
 
-Jul 31
-
-Your customers can now set up their own OIDC connections. Self-serve SSO lets you delegate enterprise SSO configuration to your customers' IT admins, without giving them Dashboard access. In addition to SAML, it now supports custom OpenID Connect (OIDC) providers.
-
-Note
-
-Self-serve SSO is only available for applications using Clerk Organizations.
-
-HOW IT WORKS
-
-The Security tab in <OrganizationProfile /> now has an OpenID Connect (OIDC) group in the provider picker, alongside SAML. An admin with the org:sys_entconns:manage permission selects OIDC Provider and sets up the connection end-to-end:
-
- * Domains: Add one or more domains and verify ownership of each with a DNS TXT record.
- * Connection: Create an OIDC application in the identity provider using the authorized redirect URI Clerk displays, then supply the provider's endpoints — a discovery endpoint, or the authorization, token, and user info URLs — along with the client ID and client secret. Clerk reads sub and email from the ID token, and given_name and family_name when the provider sends them.
- * Test: Run a test sign-in to confirm the connection works end-to-end.
- * Activate: Turn the connection on once the test passes.
-
-The connection is scoped to the Organization it's configured in and behaves like any other enterprise connection once it's live: users with a matching email domain sign in through the configured provider.
-
-GET STARTED
-
-Self-serve SSO is enabled per Organization. In the Clerk Dashboard⁠, select an Organization, open its Settings, and turn on Allow this organization to set up enterprise SSO under Organization permissions. The Security tab then surfaces wherever your app renders <OrganizationProfile />.
-
-For setup details and requirements, refer to the self-serve SSO documentation.
-
 Support
\ No newline at end of file