clerk-cli
Clerk CLI
Run bunx clerk@latest --mode agent from the user's project directory, where the linked application and env files resolve. Never install the CLI globally or through npm, npx, pnpm, or yarn. Helpers live under the skill directory:
CLERK_SKILL_DIR="${CLERK_SKILL_DIR:-$HOME/.agents/skills/clerk-cli}"
Explicit user instructions override anything below.
Access
CLERK_SECRET_KEY in the environment authenticates Backend API work; it never appears in --secret-key, output, commits, or generated artifacts. Helpers read it from the shell, then the nearest .env.local, then the nearest .env walking upward, parsing only CLERK_SECRET_KEY and CLERK_API_VERSION without sourcing the file. Because a parent env file can silently select an instance, check the key source and instance reported by whoami or the preflight before any mutation.
bash "$CLERK_SKILL_DIR/scripts/clerk-ensure.sh" checks Bun, the CLI, curl, jq, key source, API version, and authentication with one GET /v1/instance; run it only when the task needs live access. clerk auth login, clerk open, clerk users open, and any URL-opening option need the user's explicit request. Missing dependencies are reported, never installed automatically.
Target with the linked app or explicit --app <id> and --instance <dev|prod|id>. api ls and current --help are the source of truth for endpoints and flags; for version-sensitive behavior beyond them, use Context7 with official Clerk docs.