[umeraamir69]

Fixes #10352

authenticateRequest passes the incoming request's User-Agent into createBackendApiClient. verifyAPIKey then sends that header to Backend API, so a Python urllib client (Python-urllib/3.11) gets HTML 403 instead of a JSON verify response.

This keeps the SDK User-Agent on that outbound call only.

Test plan

• Unit test: verify an API key with userAgent: Python-urllib/3.11 still sends @clerk/backend@…

[changeset-bot]

🦋 Changeset detected

Latest commit: 2663119

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 11 packages

Name	Type
@clerk/backend	Patch
@clerk/astro	Patch
@clerk/express	Patch
@clerk/fastify	Patch
@clerk/hono	Patch
@clerk/nextjs	Patch
@clerk/nuxt	Patch
@clerk/react-router	Patch
@clerk/tanstack-react-start	Patch
@clerk/testing	Patch
@clerk/swingset	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

@umeraamir69 is attempting to deploy a commit to the Clerk Production Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Source mode: Auto
• Repository: clerk/javascript
• Branch: main
• File: .coderabbit.yaml
• Commit: 141916c
• Layers: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 7850477d-3830-473f-af53-94ab1924bda5

📥 Commits

Reviewing files that changed from the base of the PR and between 141916c and 2663119.

📒 Files selected for processing: 3

• .changeset/api-key-verify-user-agent.md
• packages/backend/src/tokens/__tests__/verify.test.ts
• packages/backend/src/tokens/verify.ts

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• clerk/clerk_go (manual)
• clerk/dashboard (manual)
• clerk/accounts (manual)
• clerk/backoffice (manual)
• clerk/clerk (manual)
• clerk/clerk-docs (manual)
• clerk/cloudflare-workers (manual)

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 2 remain after this review.

📝 Walkthrough

verifyAPIKey now sets the backend API client’s User-Agent to the SDK USER_AGENT. A test checks that verification does not forward an incoming Python-urllib/3.11 User-Agent and returns data without errors. A patch changeset describes the update.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Severity of issue fixed: Medium

Suggested reviewers: jacekradko

Merge Risk: ⚪ Minimal · up to 26631

The outbound User-Agent behavior is covered by the added verification test, with no identified release risk.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description check		The description directly explains the User-Agent forwarding issue, the API key verification fix, and the associated unit test.
Title check		The title clearly and concisely describes the main change: using the SDK User-Agent during API key verification.
Linked Issues check		Issue #10352 requires API-key verification to succeed independently of the incoming User-Agent. verifyAPIKey now calls createBackendApiClient({ ...options, userAgent: USER_AGENT }), so the outboun…
Out of Scope Changes check		The changes are limited to the Issue #10352 fix. The source change sets the SDK User-Agent only for API-key verification. The unit test validates this behavior. The backend patch changeset documents t…

Full details: Linked Issues check

Explanation

Issue #10352 requires API-key verification to succeed independently of the incoming User-Agent. verifyAPIKey now calls createBackendApiClient({ ...options, userAgent: USER_AGENT }), so the outbound verification request uses the SDK User-Agent. The added unit test supplies an incoming Python-urllib/3.11 User-Agent, checks @clerk/backend@0.0.0-test on the verification request, and checks a successful verification result.

Full details: Out of Scope Changes check

Explanation

The changes are limited to the Issue #10352 fix. The source change sets the SDK User-Agent only for API-key verification. The unit test validates this behavior. The backend patch changeset documents the fix. No unrelated change is shown.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files. (1 skipped: 1 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

✨ Finishing Touches: 💡 1

🛠️ Fix failing CI checks: 💡

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Linked repositories: Some configured repositories could not be included in this review. Cross-repository analysis may be incomplete. Please check linked-repository access and settings.

_{Comment @coderabbitai help to get the list of available commands.}