auth

Install a provider SDK such as @clerk/nextjs, wrap your root layout in ClerkProvider, and add clerkMiddleware to middleware.ts. Use createRouteMatcher with auth.protect() to guard specific routes like /dashboard.

Clerk offers the fastest Vercel setup with native Marketplace integration and pre-built UI components. Descope suits passwordless flows with a visual builder, while Auth0 fits enterprise SSO, SAML, and multi-tenant requirements.

Call auth() inside your route handler and check the returned userId, returning a 401 response when absent. Alternatively, configure clerkMiddleware with createRouteMatcher to protect /api paths before requests reach handlers.

Yes, Clerk is a native Vercel Marketplace integration. Running vercel integration add clerk auto-provisions CLERK_SECRET_KEY and NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY environment variables with unified billing.

In Clerk Core 3, auth() is asynchronous and must be awaited: const { userId } = await auth(). The synchronous call pattern and authMiddleware() were removed, so migrate to clerkMiddleware() and await auth.protect().

Manual JWT handling with jsonwebtoken is discouraged for application auth. Managed providers like Clerk or Auth.js provide built-in JWT session handling, CSRF protection, and token rotation without custom cryptographic code.