Clerk account recovery

Connect Clerk to Nametag to let your users securely reset their own multifactor authentication (MFA) and passwords after verifying their identity. The steps below cover connecting the provider. For the rest of the setup — self-service permissions, the self-service site, and monitoring — see the self-service account recovery administrator’s guide.

Clerk includes settings options for resetting multifactor authentication and setting a temporary password.

The first thing you’ll need to do is configure self-service permissions.

Gather information from Clerk

To connect Clerk to Nametag, you’ll need a Backend API secret key for the Clerk instance you want to protect. Nametag uses it only to reset MFA and passwords after a successful verification; create a dedicated key so you can rotate or revoke it independently.

1. Sign in to the Clerk Dashboard.
2. Select the application and the instance (development or production) you want to connect.
3. Go to Configure > API keys.
4. Copy the Secret key (it begins with sk_live_ or sk_test_) and note it for the next step.
5. Note your instance name (for example quick-lion-42) so you can label the connection.

Note: The secret key is Clerk’s credential, not a Nametag key. Nametag stores it encrypted and never writes any personal data back into Clerk.

Configure Nametag

1. Sign in to the Nametag console.
2. Select Integrations in the left-hand navigation.
3. Select New integration.
4. Choose Clerk from the list of providers.
5. Enter the Secret key and instance you obtained from the Clerk Dashboard.
6. Press Connect to Clerk.

Once connected, choose which recovery actions your users may perform (reset MFA and/or set a temporary password) in self-service permissions.

Note — Clerk Client Trust: Clerk may prompt a user for MFA the first time they sign in from a new device, even right after a reset. This is expected Clerk behavior, not a failed recovery — the user enrolls a new factor.