Clerk

Overview
How to connect
Automated checks
Useful links

DSALTA connects to Clerk using read-only API access to collect compliance evidence automatically. Data feeds into your Data Library modules.

Read-only access. DSALTA never modifies, creates, or deletes resources in your Clerk account.

DSALTA collects this integration’s data when you connect it — you can refresh it at any time with Sync from integrations on the Integrations page. The compliance checks below re-run once a day at 02:00 America/New_York.

What DSALTA reads

DSALTA reads the users of the Clerk application instance your Secret key belongs to — the people who sign up to your product, not your Clerk Dashboard teammates. For each one it collects the name, email, active status and two-factor status, which appear on your Access page. The two access checks below compare that list to your People page, so on a consumer-facing app every signed-up customer is measured against your employee directory. Clerk’s user API has no role concept, so the role column is left blank (—) for every user.It calls these Clerk endpoints:

/v1/users

Every request is a read. DSALTA has no code path that creates, modifies, or deletes anything in your Clerk environment.

Troubleshooting

Integration shows Disconnected

There is no Reconnect button. Open Integrations → Connected, click Manage on the Clerk card, and check the Status tab — it shows either Connected and working properly or Connection issues detected. To restore a broken connection you must Disconnect and connect again, which permanently deletes the data and tests collected from Clerk. This can happen if the Secret key was revoked or rotated in the Clerk Dashboard.

Data is not syncing

Confirm the Secret key is current (it may have been rotated under Configure → API keys in the Clerk Dashboard), then click Sync from integrations on the Integrations page (Connected tab) — it refreshes every connected integration at once.

Start in DSALTA

Open Integrations in the DSALTA sidebar, find Clerk, and click Connect to open the connect panel.

Open the Clerk Dashboard

Go to dashboard.clerk.com and select your application. A standard Clerk account works; no paid or enterprise plan is required.At the top left of the dashboard, select both the application and the environment — Development or Production — before you open API keys. That selector decides whether you get an sk_test_ or an sk_live_ key, and DSALTA reads the users belonging to whichever instance the key came from, so pick the environment whose roster you want on your Access page.

Open API keys

Open Configure in the top navigation, then choose API keys under Developers in the left sidebar.

Clerk Dashboard with Configure selected in the top nav and Developers > API keys highlighted in the sidebar

Copy your Secret key

Copy the Secret key (sk_live_… for production, or sk_test_… for development). You will paste it in the next step.

Make sure you copy the Secret key and not the Publishable key. The Publishable key starts with pk_test_ or pk_live_ and is designed to be exposed in frontend code — it will not authenticate DSALTA. Only the Secret key, which starts with sk_, works here.

Clerk supports several active Secret keys at once — use + Add new key on this page to mint one just for DSALTA rather than pasting the key your application already runs on. If it ever leaks you can then rotate DSALTA’s key on its own without redeploying your app.

A Clerk Secret key cannot be scoped down — it carries full access to that instance’s Backend API. DSALTA only ever issues GET /v1/users, but the credential itself is unrestricted, so store it like a production secret and rotate it if it is ever exposed.

Finish in DSALTA

Return to the connect panel you opened in step 1, enter the credential you just created, and confirm to complete the connection.

DSALTA's Link Clerk account panel with a Secret Key field

Once connected, Clerk appears on the Connected tab and the checks below begin reporting after the first sync.

Each check below re-runs once a day, at 02:00 America/New_York, while this integration is connected. Click any check for step-by-step remediation guidance.

Check	Severity	What it verifies
User access to Critical System should be valid	Info	Checks that everyone with Clerk access is an active employee on the People page.
Offboarded users should not have active access	High	Checks that offboarded employees no longer have active Clerk access.
MFA should be enabled for all users	High	Checks that every active Clerk user has multi-factor authentication enabled.

Topic	Link
Setup	Clerk: rotate your API keys
Setup	Clerk environment variables and key prefixes
General	Clerk website
DSALTA	Connection error messages

Getting Connected

Identity Providers

Cloud Infrastructure

Code Repositories

Security & Monitoring

Databases

SaaS & Productivity

What DSALTA reads

Troubleshooting

​What DSALTA reads

​Troubleshooting

What DSALTA reads

Troubleshooting