openapi: 3.0.3
info:
  title: Clerk Backend Allowlist & Blocklist JWKS API
  description: 'The Clerk Backend API manages Clerk''s authentication and user management resources server-side: users, organizations and memberships, sessions, clients, sign-ups, JWT templates, JWKS, email/SMS verification and templates, allowlist/blocklist identifiers, invitations, SAML/enterprise connections, OAuth applications, and Svix-powered webhooks. The base URL is https://api.clerk.com/v1 and every request (except GET /jwks and the public interstitial) is authenticated with your instance Secret Key passed as `Authorization: Bearer sk_...`. This description is grounded in Clerk''s published OpenAPI spec (github.com/clerk/openapi-specs, bapi) but is a curated subset covering the primary resource groups; it does not enumerate every parameter or schema property. Verify the current version-dated spec on GitHub for the authoritative contract.'
  version: '2026-05-12'
  contact:
    name: Clerk
    url: https://clerk.com
  license:
    name: Clerk Documentation
    url: https://clerk.com/docs
servers:
- url: https://api.clerk.com/v1
  description: Clerk Backend API
security:
- bearerAuth: []
tags:
- name: JWKS
  description: Public keys for verifying Clerk-issued JWTs.
paths:
  /jwks:
    get:
      operationId: getJWKS
      tags:
      - JWKS
      summary: Retrieve the JSON Web Key Set
      description: Returns the JSON Web Key Set of public keys used to verify Clerk-issued JWT signatures. This endpoint is unauthenticated and not rate limited.
      security: []
      responses:
        '200':
          description: The JWKS document.
          content:
            application/json:
              schema:
                type: object
                properties:
                  keys:
                    type: array
                    items:
                      type: object
                      additionalProperties: true
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: 'Your Clerk instance Secret Key (starts with sk_test_ or sk_live_) passed as `Authorization: Bearer YOUR_SECRET_KEY`.'