clerk-webhooks

To verify Clerk webhook signatures in Next.js App Router, call verifyWebhook(req) inside your POST handler using the CLERK_WEBHOOK_SECRET environment variable. This validates incoming requests to prevent spoofed payloads before parsing event data.

Clerk webhooks return errors when routes are protected by Clerk middleware or lack signature verification. You must make webhook routes public by excluding them from Clerk middleware and mandatorily call verifyWebhook(req) using CLERK_WEBHOOK_SECRET to validate incoming requests.

To sync Clerk user events to a Prisma database, create a Next.js App Router POST handler that verifies the webhook signature, then maps user.created, user.updated, and user.deleted event payloads directly to Prisma create, update, and delete operations for real-time database consistency.

Yes, you can use Clerk webhooks with Express instead of Next.js App Router. The implementation requires parsing the raw request body for signature verification via verifyWebhook(req) and applying the same event mapping logic for user and organization lifecycle events.

For database sync, you should handle Clerk lifecycle events including user.created, user.updated, user.deleted, organizationMembership.created, and organizationMembership.deleted to keep your backend records consistent with authentication and organization membership changes.

Yes, you must exclude Clerk webhooks from authentication middleware. Webhook routes must be public so external Clerk servers can reach them, relying entirely on verifyWebhook(req) and CLERK_WEBHOOK_SECRET for request authenticity instead of session-based authentication.