clerk-tanstack-patterns

Create a createServerFn that calls auth() from @clerk/tanstack-react-start/server, throw redirect({ to: '/sign-in' }) when isAuthenticated is false, and call that function in the route's beforeLoad. Child routes of a guarded layout route inherit the protection automatically.

Import auth from @clerk/tanstack-react-start/server inside your createServerFn handler and await it to get isAuthenticated, userId, and orgId. Throw an error or redirect when the user is not authenticated, then return the auth data for loaders or components.

An empty auth() result means clerkMiddleware is not registered in src/start.ts. Add clerkMiddleware() to the requestMiddleware array in createStart so Clerk auth state is attached to every incoming request.

Server-side auth() and clerkMiddleware must be imported from @clerk/tanstack-react-start/server, while client hooks like useAuth and useUser come from the package root. Mixing these import paths causes runtime errors.

Return an object containing userId from beforeLoad, then access it in the loader through the context parameter. The route component reads the loader result with Route.useLoaderData().

Yes, call auth() from @clerk/tanstack-react-start/server inside the API route handler and return a 401 Response when isAuthenticated is false. Do not use client-side hooks in server handlers.