Sign up for Clerk and keep its API key out of agent context

What this setup unlocks

Use Clerk for application authentication and user management while Trusty Squire injects the credential only into allowed provider requests.

• Add sign-up and sign-in to a new web application.
• Provision authentication for a prototype.

What your agent does

These public steps preserve the active registry flow while omitting captured account identifiers, brittle DOM selectors, and literal form values.

1. 01

   navigate

   Open the Clerk account console.

2. 02

   fill

   Enter the generated signup email alias.

3. 03

   fill

   Enter a generated password through the sealed browser session.

4. 04

   click

   Continue through the account flow.

5. 05

   await email code

   Receive and enter the email verification code through the sealed verification flow.

6. 06

   click

   Create a new API credential.

7. 07

   extract via regex

   Capture the validated credential directly into the vault.

Credential saved to the vault

• CLERK_API_KEY

  An environment-specific Clerk backend secret. Development instances use sk_test_; production instances use sk_live_. Creating or promoting a production instance is separate from this reviewed signup flow.

Use it without revealing the provider key

In the Vault, first make api.clerk.comthe credential's primary allowed host. Then ask your agent to call grant_app_access. It returns a host-scoped egress base URL and a revocable token; the backend uses those values to list users from the Clerk Backend API.

// One-time Vault policy: make api.clerk.com
// the primary allowed host. Off-allowlist requests are refused.

// Then ask your agent to create a scoped grant:
grant_app_access({
  service: "clerk",
  rate_limit_per_hour: 100
})

// Inject the returned fields from backend-only secret storage:
// SQUIRE_EGRESS_BASE_URL=<returned base_url>
// SQUIRE_EGRESS_TOKEN=<returned token>

const response = await fetch(
  `${process.env.SQUIRE_EGRESS_BASE_URL}/v1/users?limit=10`,
  {
    headers: {
      Authorization: `Bearer ${process.env.SQUIRE_EGRESS_TOKEN}`,
    },
  },
);

if (!response.ok) throw new Error(`Clerk returned ${response.status}`);
const users = await response.json();

Provider request checked against Clerk Backend API: list users on 2026-07-15.