clerk-tanstack-patterns

To protect TanStack React Start routes with Clerk authentication, use the beforeLoad hook to throw a redirect to your sign-in page for unauthenticated users, ensuring server-side route initialization securely blocks unauthorized access.

Your TanStack beforeLoad redirect fails because you are returning the redirect instead of throwing it. You must throw the redirect during route initialization to properly halt execution and block unauthenticated access.

You secure server functions in TanStack React Start by using createServerFn and calling Clerk’s auth helper from @clerk/tanstack-react-start/server to centralize authentication checks within your server-executed handlers.

Yes, Clerk auth requires wiring clerkMiddleware() inside the Vinxi startInstance configuration to ensure the server auth context is available for route loaders and server functions across your TanStack application.

The best way to pass Clerk auth context to TanStack route loaders is to extract authenticated user data within beforeLoad and pass it down, enabling nested loaders to render secure, organization-aware results.