Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

API key verification forwards client User-Agent, causing Python urllib requests to fail

Open
  • Is something wrong?
#10,352 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

@umeraamir69 is already working on this.

Since Oct 22, 2026.

  • #10358 by @umeraamir69 — open

Assessment

Difficulty
1/5
Estimated time
1-3 hours
Newbie friendliness
25/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Stale
Tech stack
node.js, typescript
Domain
api, authentication

Research direction

The report names verifyAPIKey() and createBackendApiClient(options) in @clerk/backend, and includes a reproduction repository with an npm run repro script. Read the verification path and compare the outbound request's User-Agent with the incoming request; run the reproduction with both User-Agent values. Done when both requests authenticate successfully with the same credentials. An open linked pull request (#10358) indicates work is already underway.

Written by the indexing model from the issue text.

Description

needs-triage
Preliminary Checks
Reproduction

https://github.com/jandorn/clerk-api-key-user-agent-repro

Publishable key

pk_live_Y2xlcmsudGVsZXNjb3BlLmVuZXJneSQ

Description

Steps to reproduce:

  1. Clone the reproduction repository and run npm ci.
  2. Copy .env.example to .env and configure credentials from the same Clerk instance, including a valid API key.
  3. Run npm run repro.

The script uses unpatched @clerk/[email protected] and calls authenticateRequest(request, { acceptsToken: 'api_key' }) twice with the same credentials. Only the incoming User-Agent changes.

Expected behavior:
Both requests authenticate successfully.

Actual behavior:

  • Python-urllib/3.11 → upstream HTTP 403 (text/html), isAuthenticated: false, reason: unexpected-error.
  • clerk-api-key-repro/1.0 → upstream HTTP 200 (application/json), isAuthenticated: true.

The full live output is included in the reproduction README.

Suspected cause:
verifyAPIKey() passes the authentication context to createBackendApiClient(options). The context's incoming userAgent overrides the SDK's default User-Agent.

Using the SDK User-Agent for this outbound request resolved the issue in our application:

const client = createBackendApiClient({ ...options, userAgent: USER_AGENT });
Environment
System:
    OS: macOS 27.0.1
    CPU: (15) arm64 Apple M5 Pro
    Memory: 75.17 MB / 24.00 GB
    Shell: 5.9 - /bin/zsh
  Binaries:
    Node: 23.11.0 - /opt/homebrew/bin/node
    npm: 11.19.1 - /opt/homebrew/bin/npm
    pnpm: 10.11.0 - /opt/homebrew/bin/pnpm
    bun: 1.3.9 - /Users/jandorn/.bun/bin/bun
  Browsers:
    Chrome: 155.0.8059.85
    Firefox: 144.0.2
    Safari: 27.0.1
  npmPackages:
    @clerk/backend: 3.2.2 => 3.2.2
Dominant language
TypeScript
Stars
1.8k
Forks
483
Avg merge
1d 23h
Merged PRs (30d)
325

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from clerk/javascript

All issues in clerk/javascript

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.