# Using Clerk for Authentication in InsForge

20 Apr 2026 • 3 minutes

Carmen Dou

Software Engineer

InsForge now supports [Clerk](https://clerk.com/) for authentication.

Clerk handles sign-up, sessions, and user management; InsForge keeps your database and Row Level Security. The two connect through a single JWT template — no user sync, no custom backend.

## How It Works

Clerk signs the session token with **InsForge's JWT secret**. InsForge accepts it natively — no exchange service, no user sync, no custom middleware.

1. Create a JWT template in Clerk. Set the algorithm to `HS256` and paste InsForge's JWT secret as the signing key.
2. Add two claims: `role: "authenticated"` and `aud: "insforge-api"`.
3. In your app, pass the Clerk-issued token to the InsForge SDK.
4. Write RLS policies against the `sub` claim. Done.

## The Bridge: insforge.ts

Normally, the InsForge SDK carries its own session token. With Clerk, there is no InsForge session — so `insforge.ts` grabs the token from Clerk and hands it to the SDK:

```typescript

```

That swap is the integration. Everything else is scaffolding.

## Three Prompts

You don't write the bridge file by hand. InsForge ships skills that teach coding agents how its SDK, RLS, and integrations work. Three prompts scaffold the whole app:

1. Set up the InsForge client with Clerk.
2. Create a todos table with RLS so users only see their own rows.
3. Build the todo page with full CRUD.

Review the diff. Ship.

## What Lives Where

After signup, the split is clean:

- **Clerk Dashboard → Users**: every user, email, session, login history.
- **InsForge Dashboard → Database**: app data, each row tagged with the user.
- **InsForge Dashboard → Auth → Users**: empty. Clerk owns the identity; InsForge only sees the sub claim per request.

## Get Started

- [Clerk integration guide](/content/integrations/clerk/index.html)
- [Browse all integrations](/content/integrations/index.html)
- [Star us on GitHub](https://github.com/InsForge/InsForge)
- [Follow us on X](https://x.com/InsForge_dev)