Skip to Content
🔐 Faable AuthMigration GuidesMigrate from Clerk

Migrate from Clerk to Faable Auth

Short answer: Migrating from Clerk to Faable Auth means moving from Clerk’s component-first model to a standards-based OAuth 2.0 / OpenID Connect identity server. You recreate your Clerk instance as a Faable Account, your application as one or more Clients, and your social/email connections one-to-one, then export your users from Clerk and import them into Faable. The biggest practical difference is the integration style: instead of Clerk’s prebuilt React components you use standard OAuth flows via @faable/auth-js or a framework quickstart. Teams typically move for European data sovereignty (GDPR), standards portability (no vendor-specific SDK lock-in), and bundling with Faable Deploy.

Concept mapping

ClerkFaable AuthNotes
Instance (dev/prod)AccountYour isolated identity boundary
ApplicationClientSPA, native, regular web, or M2M
Social connection / Email & passwordConnectionsocial, database, passwordless
OrganizationsTeams within an accountMulti-tenant by design
Prebuilt components (<SignIn/>, <UserButton/>)Universal Login + your UIHosted login screen; build your own UI with the SDK
WebhooksWebhooksAsync events to your backend
Backend API / JWT verificationAPIs + standard OIDC JWTsVerify tokens against the JWKS endpoint

Migration steps

  1. Create your Account in the Faable Dashboard  and note your issuer URL.
  2. Recreate Connections for each Clerk login method — email/password as a database connection, social as social connections, and magic link / OTP as passwordless.
  3. Create your Client(s). Most Clerk apps map to a single SPA or regular-web Client; copy your redirect/callback URLs.
  4. Replace components with flows. Swap Clerk’s React components for the standard Authorization Code + PKCE flow using the SDK. Hosted Universal Login covers the login UI; you keep full control of the rest of your app.
  5. Export and import users. Export users from the Clerk Dashboard (CSV) and import them with faable auth users import users.csv --from clerk. Users keep their passwords: Clerk’s bcrypt, Argon2 and PBKDF2 digests import as they are and are upgraded to Argon2id on first sign-in. Rows hashed with a fast digest (MD5, SHA-256) are reported and need Forgot password. Run it with --dry-run first. See Import and export password hashes.
  6. Verify tokens the standard way. Replace Clerk’s session helpers with standard OIDC JWT verification against Faable’s JWKS endpoint (built into the SDK and quickstarts).
  7. Cut over behind a flag, then decommission the Clerk instance.

Things that change (and things that don’t)

  • No change: your underlying need — sign-up, login, sessions, social login — all supported.
  • Second factor: two-step verification is built in (authenticator apps, security keys and passkeys), but enrolments do not migrate — users re-enrol on first login under a required policy.
  • Changes: you move from Clerk-specific components to standard OAuth/OIDC flows, which removes SDK lock-in but means building (or restyling) some UI.

Last updated on

Migrate from Auth0Migrate from Keycloak