clerk-orgs

Enable Organizations in the Clerk Dashboard, then render <OrganizationSwitcher /> and read orgId from auth() to scope data. Gate routes with has({ role: 'org:admin' }) or permission checks, and verify the URL slug matches the active orgSlug on every org-scoped page.

Destructure has from await auth() and call has({ role: 'org:admin' }) or has({ permission: 'org:sys_memberships:manage' }). Use only canonical System Permission slugs like org:sys_memberships:manage — invented slugs such as org:manage_members always return false.

Membership required is the default mode since August 22, 2025, and it disables personal accounts. Switch to Membership optional in Dashboard → Organizations settings if your app needs B2C and B2B coexistence.

Add a SAML or OIDC connection in Dashboard → Configure → Enterprise Connections, scoped to the organization with its domain. Users auto-join via JIT provisioning, and provider metadata is read from user.enterpriseAccounts[i].enterpriseConnection?.provider.

When Clerk Billing is enabled, permissions are gated at the feature level — the Feature associated with that permission must be included in the organization's active Plan. Check Dashboard → Billing → Plans → Features and attach the required Feature.

Call clerk.organizations.createOrganizationInvitation with organizationId, inviterUserId, emailAddress, role, and redirectUrl after verifying the caller has org:sys_memberships:manage. The inviterUserId parameter is required for human-initiated invitations.