Clerk change
ClerkClerk secret key not showing in the Dashboard: since October 19, 2026, the full key is shown only once, when you add it
Since October 19, 2026, the API keys page in the Clerk Dashboard shows a Secret key's full value only when you add it; after that it shows part of each key, so you can match it to the one in your environment. Existing Secret keys keep working, and Clerk says you do not need to rotate them. If you no longer have the value, for example for a new Vercel project or because a coding agent told you to copy it from the Dashboard, add a new Secret key, set it as CLERK_SECRET_KEY in .env.local and in Vercel's environment variables for each environment that uses it, redeploy, and delete the old key once nothing uses it. A Secret key starts with sk_test_ in a development instance and sk_live_ in production. Checked against Clerk's changelog and docs on 2026-10-28.
If the app now fails without the key, see the Clerk keys missing error and its fix.
Why the steps you were given no longer match the Dashboard
Setup guides and coding agents written before October 19 say to copy the Secret key from the API keys page. Clerk changed that page to reduce the chance of a key leaking: the full value appears once, when the key is added, and only part of it afterwards. Code snippets on the page that need a Secret key now let you add a new key without leaving it.
Add a new key and swap it in
Add the key on the API keys page and copy it right away. Set CLERK_SECRET_KEY in .env.local for local work, and in the Vercel project's environment variables for Production and Preview if both use Clerk. Vercel applies a changed variable only to new deployments, so redeploy. Delete the old key when every environment runs with the new one; Clerk's changelog gives that order.
# .env.local
NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=pk_test_...
CLERK_SECRET_KEY=sk_test_...Keep it out of public variables
Clerk's environment variable docs say not to expose the Secret key with a public variable. A NEXT_PUBLIC_ or VITE_ name is copied into the browser bundle at build time, so CLERK_SECRET_KEY must keep a server-only name.
Checklist
When you cannot find the Clerk Secret key
- 01Match the partial key on the API keys page to the value in .env.local and in Vercel, to see which key each environment uses.
- 02If the value is lost, add a new Secret key and copy it before you leave the page.
- 03Set CLERK_SECRET_KEY to the new value in .env.local and in each Vercel environment that uses it, then redeploy.
- 04Delete the old key once no environment uses it.
- 05Check that no Secret key sits in a public variable or in code:
grep -rnE "NEXT_PUBLIC_CLERK_SECRET|VITE_CLERK_SECRET|sk_(test|live)_" --exclude-dir=node_modules --exclude-dir=.next .
Related
Related guides
Sources
Official docs behind this checklist
Browse all launch guides · Read resources · How to make and check your next change
FAQ
FAQ for builders before launch
Do I have to rotate my existing Clerk Secret keys?
No. Clerk's changelog says existing Secret keys keep working and do not need rotating. Add a new one only when you need a value you no longer have.
Can I see the full key again later?
Not on the API keys page: it shows the full value only when you add the key. Keep it where your deployments read it, such as Vercel, and in your team secret store.