# Clerk solution docs

- [Clerk impersonation, the act claim, and what to lock while it is on](https://agenticboilerplate.com/cookbook/clerk/clerk-impersonation-and-the-act-claim): When an admin signs in as a user from the Clerk dashboard, the session token carries an act claim. Read it on the server, show a banner, and refuse account changes until it ends.
- [Protecting route handlers is not the same as protecting pages](https://agenticboilerplate.com/cookbook/clerk/protecting-handlers-vs-pages): A redirect is the right answer for a page and a terrible answer for fetch. Use 401 and 403 in route handlers, and never let the proxy be the only check.
- [Clerk roles: publicMetadata or your own table?](https://agenticboilerplate.com/cookbook/clerk/roles-publicmetadata-vs-local-table): publicMetadata is free and instant but vendor state you cannot join on. A local roles table joins and audits but must be kept in sync. Pick per what you need to query.
- [Make Clerk's sign-in look native, in light and dark, with CSS variables](https://agenticboilerplate.com/cookbook/clerk/styling-clerk-with-css-variables): Point Clerk's appearance variables at your design's CSS custom properties so the prebuilt components follow your theme and your dark mode, with no copied hex values.
- [Testing a Clerk webhook locally without a tunnel round trip](https://agenticboilerplate.com/cookbook/clerk/testing-clerk-webhooks-locally): Sign the payload yourself and POST it at localhost. You get replays, retry ids and bad-signature cases in one second instead of thirty.
- [The proxy matcher that also matches your static assets](https://agenticboilerplate.com/cookbook/clerk/the-matcher-that-ate-your-static-assets): A matcher like "/(.*)" runs auth on every CSS file, image and font. The symptoms are an unstyled site, a redirect loop, or a surprising invocation bill.
- [Clerk user-sync webhooks: duplicates, retries and out-of-order events](https://agenticboilerplate.com/cookbook/clerk/webhook-idempotency-and-ordering): Svix retries and can deliver twice, and updates can arrive before creates. Make the write idempotent on the user id and reject stale payloads by timestamp.

---

Agentic Boilerplate: A Next.js repo your agent already knows. Free during launch, then $99 once.

- Site map for agents: https://agenticboilerplate.com/llms.txt
- Public API: https://agenticboilerplate.com/openapi.json
- Contact: agenticstudio@gmail.com