Set up a Clerk connector

C1 provides identity governance for Clerk. Integrate your Clerk instance with C1 for unified visibility and governance over user access.

Capabilities

Resource	Sync	Provision
Users
Organizations
Organization roles
Organization permissions

Gather Clerk credentials

Use a Clerk Secret Key for the Clerk instance you want to sync. Clerk Secret Keys have broad Backend API access. The connector performs read-only API calls, but the key itself is not scoped to read-only access by Clerk.

1. Sign in to the Clerk Dashboard and open the application to sync.

2. Navigate to Configure > API Keys.

3. Under Secret keys, create a new key or copy an existing key.

4. Store the key securely. Production keys start with sk_live_; development keys start with sk_test_.

Configuration fields

Field	Required	Description
secret-key	Yes	Clerk Secret Key used as the Bearer credential for the Clerk Backend API.

Synced resource types

• Users: Clerk users from GET /v1/users.
• Organizations: Clerk organizations from GET /v1/organizations.
• Organization roles: instance-wide organization role definitions from GET /v1/organization_roles.
• Organization permissions: instance-wide organization permission definitions from GET /v1/organization_permissions.
• Organization membership grants: user memberships emitted as organization grants. Each membership receives the generic member grant and, when the membership role can be resolved, the matching role grant.

Special notes

• All Clerk resource types are opt-in.
• Organization memberships are not separate resources; they are grant edges on the organization resource.
• The connector resolves membership role keys to stable Clerk role IDs before emitting role grants.
• Clerk list APIs use limit and offset pagination. The connector requests the largest supported page size.
• On rate limit responses, the connector follows Clerk’s Retry-After header.

Configure the Clerk connector

Cloud-hosted

Follow these instructions to use a built-in, no-code connector hosted by C1.

1. In C1, navigate to Integrations > Connectors and click Add connector.

2. Search for Clerk and click Add.

3. Choose how to set up the new Clerk connector.

4. Set the owner for this connector.

5. Click Next.

6. Find the Settings area of the page and click Edit.

7. Paste the Clerk Secret Key into Clerk Secret Key.

8. Click Save.

9. The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.

Done. Your Clerk connector is now pulling access data into C1.

Self-hosted

Follow these instructions to run the Clerk connector in your own environment.

1. In C1, navigate to Integrations > Connectors and click Add connector.

2. Search for Baton and click Add.

3. Choose how to set up the new Clerk connector, set the owner, and click Next.

4. In the Settings area, click Edit, then click Rotate to generate a new Client ID and Client Secret. Store these values securely for your deployment.

5. Configure C1 credentials and the Clerk Secret Key as environment variables:

   BATON_CLIENT_ID=<C1 client ID>
   BATON_CLIENT_SECRET=<C1 client secret>
   BATON_HOST_ID=baton-clerk
   BATON_SECRET_KEY=<Clerk Secret Key>
   
6. Deploy the connector using the Public ECR image:

   public.ecr.aws/conductorone/baton-clerk:<version>
   

   Use a version tag without the leading v, such as 0.0.3.

Done. Your Clerk connector is now pulling access data into C1.