Not signed in
\n returnHello {userId}
\n}\n\nexport default function Page() {\n return (\nNot authenticated
\n\n const res = await fetch('https://api.example.com/graphql', {\n headers: { Authorization: `Bearer ${token}` },\n })\n const data = await res.json()\n return{JSON.stringify(data)}\n}\n```\n\nRender `\n Session {session.id} — last active: {session.lastActiveAt.toISOString()}\n
\n )\n}\n```\n\n### Manual JWT verification (no Clerk middleware)\n\nFor standalone API servers that receive Clerk session tokens from the `Authorization` header or the `__session` cookie (same-origin).\n\n**Using `@clerk/backend` `verifyToken`** (recommended):\n\n```typescript\nimport { verifyToken } from '@clerk/backend'\n\nconst token = req.headers.authorization?.replace('Bearer ', '')\nif (!token) return res.status(401).json({ error: 'No token' })\n\ntry {\n const claims = await verifyToken(token, {\n jwtKey: process.env.CLERK_JWT_KEY,\n })\n // claims.sub = userId\n} catch {\n return res.status(401).json({ error: 'Invalid token' })\n}\n```\n\n**Using `jsonwebtoken`** (when you can't use `@clerk/backend`):\n\n```typescript\nimport jwt from 'jsonwebtoken'\n\nconst publicKey = process.env.CLERK_PEM_PUBLIC_KEY!.replace(/\\\\n/g, '\\n')\nconst token = req.headers.authorization?.replace('Bearer ', '')\nif (!token) return res.status(401).json({ error: 'No token' })\n\ntry {\n const claims = jwt.verify(token, publicKey, { algorithms: ['RS256'] }) as jwt.JwtPayload\n // Manually check exp and nbf (jsonwebtoken does this automatically, but verify azp if needed)\n // claims.sub = userId\n} catch {\n return res.status(401).json({ error: 'Invalid or expired token' })\n}\n```\n\nToken sources:\n- **Same-origin requests**: `__session` cookie (Clerk sets this automatically)\n- **Cross-origin / mobile / API-to-API**: `Authorization: Bearer