clerk-tanstack-patterns

Protect TanStack Start routes by using the `beforeLoad` function to validate user sessions and redirect unauthenticated users. This guards individual routes or entire route groups against unauthorized access.

Server-side auth in TanStack Start works by calling `auth()` inside `createServerFn` to validate sessions. This ensures server functions and API handlers securely verify authentication before executing protected logic.

Yes, you can pass `userId` or `orgId` through route context so loaders can fetch user-scoped or org-scoped data. This ensures loaders have the necessary authenticated context to retrieve specific data.

Yes, configuring `clerkMiddleware()` in Vinxi is required for app setup. You also need to wrap the root route with `ClerkProvider` to properly initialize Clerk authentication flows in your TanStack Start application.

Protected API routes return 401 errors when authentication is missing because server-side auth checks via `auth()` fail to validate the session. Implementing `createServerFn` with `auth()` ensures these routes reject unauthenticated requests.

The best way to guard route groups is using `beforeLoad` with redirect-based protection. This pattern ensures unauthenticated users are redirected away from protected layouts before the route renders.