auth

Install Clerk from the Vercel Marketplace with 'vercel integration add clerk', which auto-provisions environment variables, then add clerkMiddleware to middleware.ts and wrap your root layout in ClerkProvider. Descope and Auth0 are alternatives with similar middleware-based setups.

Clerk offers the fastest Vercel setup with native Marketplace integration and pre-built UI components. Descope suits passwordless and social login flows with a visual flow builder. Auth0 fits enterprise needs like SSO, SAML, and multi-tenant identity.

Use clerkMiddleware with createRouteMatcher to define protected routes like /dashboard or /api, then call await auth.protect() inside the middleware handler for matching requests. Unauthenticated users are redirected to sign-in automatically.

No, auth() is async in Clerk Core 3 and must be awaited: const { userId } = await auth(). The old authMiddleware() was removed and replaced by clerkMiddleware(), and clerkClient() is also now async.

Legacy next-auth v4 patterns using NextAuthOptions and authOptions should migrate to Auth.js v5 with the new universal auth() helper. Alternatively, managed providers like Clerk or Auth0 handle JWT sessions, CSRF protection, and token rotation built-in.

Manual password hashing with bcrypt or argon2 is discouraged when managed providers are available. Clerk and Auth0 include built-in password hashing, rate limiting, and breach detection, reducing the security burden of hand-rolled authentication.