clerk-webhooks

# Webhooks Always output complete, working, copy-paste-ready webhook handlers. Never output stubs, placeholders, or partial implementations. Include `verifyWebhook(req)` in every handler. ## CRITICAL: Always Verify Webhooks **NEVER skip signature verification**, even for notification-only handlers. Always use `verifyWebhook(req)` from `@clerk/nextjs/webhooks`. This uses the `CLERK_WEBHOOK_SECRET` env var automatically. ## CRITICAL: Make Webhook Route Public Webhook routes MUST be excluded from Clerk middleware protection. Without this, Clerk returns 401. ```typescript // proxy.ts (Next.js <=15: middleware.ts) import { clerkMiddleware, createRouteMatcher } from '@clerk/nextjs/server' const isPublicRoute = createRouteMatcher(['/api/webhooks(.*)']) export default clerkMiddleware((auth, req) => { if (!isPublicRoute(req)) auth().protect() }) ``` ## Complete Webhook Handler (Next.js App Router) ```typescript // app/api/webhooks/route.ts import { verifyWebhook } from '@clerk/nextjs/webhooks' import { NextRequest } from 'next/server' import { db } from '@/lib/db' export async function POST(req: NextRequest) { // ALWAYS verify - never skip, even for notification-only handlers let evt try { evt = await verifyWebhook(req) // uses CLERK_WEBHOOK_SECRET automatically } catch (err) { console.error('Webhook verification failed:', err) return new Response('Verification failed', { status: 400 }) } if (evt.type === 'user.created') { const { id, email_ad...