Report

Should I Use Clerk?

clerk.com·Analyzed 50 minutes ago·Based on 10 sources

The easiest way to add authentication and user management to your application. Purpose-built for React, Next.js, Remix, and 'The Modern Web'.

Depends

Buy if you're a React/Next.js team shipping fast and staying under the free tier's 50K users.

Great DX for React/Next.js auth. Pricing spikes with growth; recent auth-bypass CVEs. Fine at small scale.

Confidence: Medium

$25/mo

Starting price

Pro plan

Up to 50K users

Free tier

$0/mo

$50M Series C

Funding

Menlo Ventures + Anthropic's Anthology Fund

2.9/5

G2 rating

Clerk.dev, 4 reviews

Value for money

Widely criticized; costs spike with MAUs

Ease of use

Repeatedly called easiest auth setup

Feature depth

Orgs, SCIM, MFA, sessions, billing included

Security posture

Multiple auth-bypass CVEs, incl. CVSS 9.1

Pros

Called by far the easiest auth setup for React/Next.js developers^²
Fast, low-friction setup with few day-to-day complaints
Free tier up to 50K users before paid plans^⁴
Orgs, sessions, MFA, billing and SCIM provisioning out of the box
Well-funded: $50M Series C from Menlo and Anthropic's fund^⁸

Cons

Pricing widely criticized as predatory; costs spike with user growth
Critical middleware route-protection bypass CVE, CVSS 9.1^⁶
G2 seller rating just 2.9/5^³
Security incidents spark 'should you roll your own auth' debates
Lock-in concerns: ceding user-management control vs owning it¹⁰

Gotchas

highMAU-based pricing escalates fast; founder publicly answered 'predatory pricing' accusations
mediumFree tier terms changed in March 2024 — verify current limits before committing^¹
mediumThird-party guides document hidden fees and real costs beyond list prices
mediumMigration off Clerk is painful once sessions and auth are wired into its SDKs¹⁰

Best for

React/Next.js startups
Fast MVP launches
B2B SaaS with orgs/teams
Devs avoiding DIY auth

Not for

High-volume consumer apps — MAU pricing bites hard
Security-critical or regulated apps wanting self-custody
Non-React stacks; it's purpose-built for the modern React web
Anyone wanting predictable flat pricing

Companies that use it

Novu^⁹
Trading Experts

Pricing

Free

$0/mo

Up to 50K users
Core auth and user management

Pro

From $25/mo

Higher limits
Advanced features

Business

From $100/mo

Enterprise-grade controls
Higher volume allowances

Security

Multiple CVEs including a CVSS 9.1 auth bypass — pattern warrants monitoring before trusting it with critical flows.

CVE-2026-41248: Middleware route protection bypassCritical vulnerability (CVSS 9.1) in Clerk JavaScript SDK middleware allowing bypass of route protection.^⁶
CVE-2025-63700: OAuth flow bypassclerk-js vulnerable to bypass of OAuth authentication flow by manipulating requests at the OTP verification stage.^⁷
CVE-2026-42349: JavaScript auth bypassAuthentication bypass vulnerability in Clerk JavaScript.
CVE-2025-53548: Webhook signature bypassClerk webhook signature bypass vulnerability disclosed via Miggo's vulnerability database.