August 2025 Summaries

On August 28, a distributed credential stuffing attack on a specific tenant's authentication endpoints caused two brief periods of elevated latency and errors in both the Frontend and Backend APIs, although services remained partially available. The incident, which lasted approximately 22 minutes and 12 minutes during two separate windows, was mitigated without disruption to session token issuance. The root cause was identified as a combination of factors, including automated traffic generating high volumes of sign-in and sign-up attempts, write-intensive activity increasing contention on hot authentication-related tables, and a lagging CDC consumer under burst conditions. Errors affected 2.52% of Backend API requests and 0.14% of Frontend API requests, but there was no data loss or corruption. Remedial actions include disabling the lagging change-stream processor, strengthening adaptive protections at the edge and auth layer, and improving schema and query-path to reduce contention. Additionally, efforts will be made to enhance per-customer isolation to limit the impact of such issues in the future.

Clerk has introduced Mosaic, a new Figma design system that allows product teams to visually prototype and brand its UI components before coding, enhancing the customization of authentication processes. Similar to how Stripe simplifies transactions, Clerk offers drop-in authentication solutions that are secure, scalable, and customizable, aiming to integrate authentication seamlessly into a product's brand experience. Mosaic provides designers with an intuitive way to explore Clerk’s components, ensuring a consistent brand identity by allowing the application of brand colors, typography, and other design elements. The system facilitates an effortless transition from design to production with pixel-perfect consistency, enabling both designers and developers to collaboratively create authentication flows that match their brand. Mosaic includes interactive components and a dynamic theming system through Figma and Clerk’s CSS variables, ensuring the authentication features maintain visual cohesion and accessibility. Users can easily update their designs with new components or design improvements by manually syncing with the latest Mosaic version, ensuring that the authentication reflects their brand identity from start to finish.

As B2B SaaS platforms grow to accommodate diverse customer needs, secure and scalable multi-tenant authentication becomes essential for success. Unlike simple user authentication, which involves individual account access, multi-tenant authentication allows users to belong to multiple organizations with distinct roles and permissions, enabling data isolation and branded experiences while using a shared codebase. This complex system design requires careful consideration of identity federation, authorization models, and session management to prevent data leakage and maintain security boundaries. Implementing such a system is challenging, as it involves managing organizational contexts, invite-based access, and role-based permissions across different tenants, which can be difficult to scale and secure without incurring technical debt. Clerk simplifies this process by providing built-in tools for handling organization-based access, session tracking, role-based access control, and verified domains, thereby reducing the need for custom code and enabling faster development of secure multi-tenant SaaS applications.

Multi-tenancy in B2B SaaS applications offers significant scalability and efficiency benefits but comes with inherent risks that require proactive design considerations for tenant isolation, predictable performance, and compliance with industry standards. The article details five common risks associated with multi-tenancy, such as data leakage, complex authorization logic, noisy neighbors, compliance challenges, and difficulties in debugging. It emphasizes the importance of using modern tools like Clerk, Supabase, and Neon to mitigate these risks by ensuring secure data access, efficient resource allocation, and compliance with regulations through features like Row Level Security and per-organization roles. These tools help maintain tenant-specific isolation and observability, simplifying the management of multi-tenant environments. By addressing these risks effectively, SaaS providers can ensure their applications remain secure, scalable, and compliant, paving the way for sustained success with enterprise clients.

Clerk recently tested its automatic regional failover system, a crucial upgrade designed to protect against large-scale outages, during an incident on August 6th when their primary cloud region experienced intermittent disruptions. During the outage, traffic was successfully rerouted to a failover region, ensuring that customers experienced minimal disruption, aside from a slight increase in API latency. This event highlighted the importance of resilience for Clerk, given its role as an authentication provider whose services are integral to customer applications. The new failover system runs continuously, ensuring readiness and seamless traffic rerouting during outages, with data storage replicated to minimize latency. Clerk plans to further enhance resilience by increasing the robustness of stateful systems, exploring multi-cloud redundancy, and automating recovery processes. The successful handling of this incident validated their regional failover strategy and demonstrated a positive return on investment as they work to expand their resilience capabilities.

A recent hackathon collaboration with MiduDev, a well-known Spanish-speaking tech YouTuber, showcased innovative uses of Clerk in various applications, receiving over 150 submissions. Five standout projects were awarded, judged primarily on creativity, Clerk integration, and user experience. The first-place winner, Key Leap, creatively used Clerk as a core mechanic in an interactive game that challenges players with access-level obstacles, blending simplicity with technical depth. Finanzz, a finance management app, utilized AI and Clerk for a seamless user login experience, allowing focus on its core functionalities. SnippetLab offered a code snippet manager with social media features, leveraging Clerk for secure authentication. Atomox provided a platform for sharing visual web UI components, using Clerk to manage user profiles and authentication. SoulsPixel combined a collaborative pixel board with gamification, using Clerk for identity management and an activity feed. The hackathon celebrated technical talent and creativity, emphasizing Clerk's applicability in diverse development projects.

Multi-tenancy in B2B applications, which allows multiple organizations to be served from a single codebase, is becoming increasingly essential for driving revenue and growth. This capability, once exclusive to enterprise-level software, is now expected in even smaller-scale business apps. Notion, Slack, and Asana exemplify successful multi-tenancy integration. The text provides a detailed guide on implementing multi-tenancy in a React Native and Expo app using Clerk and Supabase, focusing on setting up user-friendly organization management features. The process involves enabling organization features, implementing organization switchers, and updating security models to ensure data privacy among tenants. Clerk simplifies multi-tenancy by offering APIs for organization management, allowing developers to focus on core functionalities. A demonstration is given using a time tracking app, Aika, where multi-tenancy is integrated to allow users to manage and switch between organizations seamlessly. Additionally, the guide outlines updating Row-Level Security policies in Supabase to use organization IDs, ensuring data is tied to the correct tenant.

React Native and Expo's cross-platform capabilities, combined with Clerk's user management and Supabase's backend, offer a comprehensive toolkit for developing production-ready mobile applications. This guide provides a detailed walkthrough on building a time tracking app named Aika from scratch, utilizing React Native and Expo for the interface, Clerk for secure authentication, and Supabase for data storage. Clerk simplifies secure user management by offering session handling and multiple authentication methods, including email/password and OAuth. Supabase, an open-source Firebase alternative, provides a PostgreSQL database with simple API access, supporting seamless integration with Clerk for enhanced security and scalability. The tutorial outlines the implementation of key app features such as a timer, authentication, user settings, and data management, culminating in a fully functional, cross-platform app that operates on both iOS and Android. Additionally, the guide highlights the benefits of using these tools to streamline development processes and ensure robust security practices, with a promise of further enhancement in future articles through Clerk's multi-tenancy features for team collaboration.