# Set up Clerk

> Create the production sign-in application and add the verified email claims that Coop invitations require.


## 1. Create a production application

Create a Clerk application for Coop. Configure the sign-in methods your company permits. Before inviting real users, make sure the application is claimed and in production mode. Development keys and temporary instances are not production credentials.

## 2. Copy the three values Coop uses

You need:

- `VITE_CLERK_PUBLISHABLE_KEY` for the browser dashboard. It normally begins with `pk_` and is public by design.
- `CLERK_ISSUER` for the API. This is an HTTPS origin with no path or trailing slash.
- `CLERK_JWKS_URL` for the API. This is the issuer's HTTPS JWKS endpoint and includes a path.

The API validates the token signature, issuer, session, expiry, and authorized dashboard origin. Coop does not need a Clerk secret key for its normal dashboard authentication flow.

## 3. Add verified email claims

In Clerk, open **Sessions → Customize session token** and save:

```json
{
  "email": "{{user.primary_email_address}}",
  "email_verified": "{{user.email_verified}}"
}
```

<figure class="doc-figure">
  <img src="/screenshots/clerk-session-token.webp" alt="Clerk Customize session token editor with Coop email claims" width="1770" height="1320" loading="lazy">
  <figcaption>Open Sessions, then Customize session token. Add the two claims to the built-in <code>__session</code> token.</figcaption>
</figure>

Use the custom session token, not a separate JWT template. Coop needs the normal session ID. Existing members can sign in without these extra claims, but accepting an invitation requires a provider-verified email.

## 4. Allow the dashboard domain

Add the production dashboard domain in Clerk's production domain settings. If you start on a provider URL and later move to a custom domain, update Clerk and the API origin allowlist together.

## 5. Verify before inviting the team

After the dashboard and API are deployed:

1. Sign in as the first owner.
2. Create an organization.
3. Create an invitation for a separate test email.
4. Open the invitation in a private browser window.
5. Sign in as that email and accept it.

If acceptance reports `verified_email_required`, inspect the active session token customization and confirm that the user's primary email is verified.

Official reference: [Customize Clerk session tokens](https://clerk.com/docs/guides/sessions/customize-session-tokens).