feat(express,fastify,tanstack-react-start,react-router): Support machine auth tokens in getAuth()

[wobsoriano]

Description

This PR is a continuation of the main Machine Authentication PR but focuses on adding the type of token option to getAuth() helper across SDKs. This is still backwards compat, and set to session_token by default.

Before:

const authObject = getAuth(req)

After:

const authObject = getAuth(req, { acceptsToken: 'sesion_token'  }) // session_token is the default to maintain backwards compat

const authObject = getAuth(req, { acceptsToken: 'api_key'  })
const authObject = getAuth(req, { acceptsToken: ['api_key', 'session_token', 'machine_token', 'oauth_token']  })

Checklist

• pnpm test runs as expected.
• pnpm build runs as expected.
• (If applicable) JSDoc comments have been added or updated for any package exports
• (If applicable) Documentation has been updated

Type of change

• 🐛 Bug fix
• 🌟 New feature
• 🔨 Breaking change
• 📖 Refactoring / dependency upgrade / documentation
• other:

[changeset-bot]

🦋 Changeset detected

Latest commit: 4c9d741

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 11 packages

Name	Type
@clerk/backend	Patch
@clerk/nextjs	Patch
@clerk/tanstack-react-start	Minor
@clerk/express	Minor
@clerk/react-router	Minor
@clerk/fastify	Minor
@clerk/agent-toolkit	Patch
@clerk/astro	Patch
@clerk/nuxt	Patch
@clerk/remix	Patch
@clerk/testing	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
clerk-js-sandbox	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Jun 5, 2025 6:13pm

[wobsoriano]

!snapshot

[clerk-cookie]

Hey @wobsoriano - the snapshot version command generated the following package versions:

Package	Version

Tip: Use the snippet copy button below to quickly install the required packages.

[pkg-pr-new]

Open in StackBlitz

@clerk/agent-toolkit

npm i https://pkg.pr.new/@clerk/agent-toolkit@6067

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@6067

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@6067

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@6067

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@6067

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@6067

@clerk/elements

npm i https://pkg.pr.new/@clerk/elements@6067

@clerk/clerk-expo

npm i https://pkg.pr.new/@clerk/clerk-expo@6067

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@6067

@clerk/express

npm i https://pkg.pr.new/@clerk/express@6067

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@6067

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@6067

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@6067

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@6067

@clerk/clerk-react

npm i https://pkg.pr.new/@clerk/clerk-react@6067

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@6067

@clerk/remix

npm i https://pkg.pr.new/@clerk/remix@6067

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@6067

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@6067

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@6067

@clerk/themes

npm i https://pkg.pr.new/@clerk/themes@6067

@clerk/types

npm i https://pkg.pr.new/@clerk/types@6067

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@6067

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@6067

commit: 4c9d741

[LekoArts]

Generally LGTM

[LekoArts]

Do we wanna add a test case that asserts that the default acceptsToken is 'any'?

[wobsoriano]

So the actual authenticateRequest() call is using 'any' and cannot be overridden. Meaning any session or machine request will be verified.

However, the acceptsToken in getAuth() (which defaults to session_token) is used after authentication to filter or coerce the returned auth object to match the expected type.

[LekoArts]

Ah, sorry, I misread lol. The changeset is saying what you're saying. So never mind :)