fix(nextjs): evaluate auth.protect() authorization params for machine tokens

[wobsoriano]

Description

auth.protect() returned as soon as a machine token was authenticated, so the role, permission, feature, plan, and reverification params and the predicate callback were never evaluated for API keys, OAuth tokens, or M2M tokens.

Machine tokens now go through the same authorization step as session tokens. Their has() always returns false, so param-based checks respond with a 401. A predicate decides on its own result.

Checklist

• pnpm test runs as expected.
• pnpm build runs as expected.
• (If applicable) JSDoc comments have been added or updated for any package exports
• (If applicable) Documentation has been updated

Type of change

• 🐛 Bug fix
• 🌟 New feature
• 🔨 Breaking change
• 📖 Refactoring / dependency upgrade / documentation
• other:

[changeset-bot]

🦋 Changeset detected

Latest commit: b4610b5

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@clerk/nextjs	Patch
@clerk/swingset	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Team
• Run ID: bb5d84cc-591c-49c8-8335-a24c49a93ff4

📥 Commits

Reviewing files that changed from the base of the PR and between 2466563 and b4610b5.

📒 Files selected for processing (4)

• .changeset/quiet-keys-protect.md
• integration/tests/next-machine.test.ts
• packages/nextjs/src/server/__tests__/clerkMiddleware.test.ts
• packages/nextjs/src/server/protect.ts

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• clerk/clerk_go (manual)
• clerk/dashboard (manual)
• clerk/accounts (manual)
• clerk/backoffice (manual)
• clerk/clerk (manual)
• clerk/clerk-docs (manual)
• clerk/cloudflare-workers (manual)
• clerk/clerk-ios (auto-detected)
• clerk/clerk-android (auto-detected)
• clerk/cli (auto-detected)

Included review availability: This review used your included allowance. 9 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 10 reviews per hour.

📝 Walkthrough

Authenticated machine-token requests now continue to shared authorization checks in auth.protect(). Tests cover authorization parameters and predicates for API key, M2M, and OAuth tokens, including expected 401 and 200 responses. Integration tests also create and clean up API-key test credentials.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to b4610

auth.protect() now evaluates authorization parameters and predicates for machine tokens, and returns 401 when they fail. No merge-blocking risk was found.

Pre-merge checks · 4 · 1

Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 3 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks (4 passed)

Check name	Status	Explanation
Description check		The description clearly explains the bug, the machine-token authorization change, expected behavior, tests, and scope.
Title check		The title clearly and concisely identifies the Next.js fix and the evaluation of auth.protect() authorization parameters for machine tokens.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 3 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@10198

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@10198

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@10198

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@10198

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@10198

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@10198

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@10198

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@10198

@clerk/expo-biometrics

npm i https://pkg.pr.new/@clerk/expo-biometrics@10198

@clerk/expo-google-signin

npm i https://pkg.pr.new/@clerk/expo-google-signin@10198

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@10198

@clerk/express

npm i https://pkg.pr.new/@clerk/express@10198

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@10198

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@10198

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@10198

@clerk/mosaic

npm i https://pkg.pr.new/@clerk/mosaic@10198

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@10198

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@10198

@clerk/react

npm i https://pkg.pr.new/@clerk/react@10198

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@10198

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@10198

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@10198

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@10198

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@10198

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@10198

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@10198

commit: b4610b5

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clerk-js-sandbox	Ready	Preview	Oct 13, 2026 4:42pm UTC
swingset	Ready	Preview	Oct 13, 2026 4:42pm UTC

[github-actions]

API Changes Report

Generated by Break Check on 2026-10-13T16:44:27.413Z

Summary

Metric	Count
Packages analyzed	19
Packages with changes	0
🔴 Breaking changes	0
🟡 Non-breaking changes	0
🟢 Additions	0

No API Changes Detected

All packages have stable APIs with no detected changes.

---

Report generated by Break Check

_{Last ran on b4610b5.}