API key verification forwards client User-Agent, causing Python urllib requests to fail #10352

Preliminary Checks

• I have reviewed the documentation: https://clerk.com/docs

• I have searched for existing issues: https://github.com/clerk/javascript/issues

• I have not already reached out to Clerk support via email or Discord (if you have, no need to open an issue here)

• This issue is not a question, general help request, or anything other than a bug report directly related to Clerk. Please ask questions in our Discord community: https://clerk.com/discord.

Reproduction

https://github.com/jandorn/clerk-api-key-user-agent-repro

Publishable key

pk_live_Y2xlcmsudGVsZXNjb3BlLmVuZXJneSQ

Description

Steps to reproduce:

1. Clone the reproduction repository and run npm ci.
2. Copy .env.example to .env and configure credentials from the same Clerk instance, including a valid API key.
3. Run npm run repro.

The script uses unpatched @clerk/[email protected] and calls authenticateRequest(request, { acceptsToken: 'api_key' }) twice with the same credentials. Only the incoming User-Agent changes.

Expected behavior:
Both requests authenticate successfully.

Actual behavior:

• Python-urllib/3.11 → upstream HTTP 403 (text/html), isAuthenticated: false, reason: unexpected-error.
• clerk-api-key-repro/1.0 → upstream HTTP 200 (application/json), isAuthenticated: true.

The full live output is included in the reproduction README.

Suspected cause:
verifyAPIKey() passes the authentication context to createBackendApiClient(options). The context's incoming userAgent overrides the SDK's default User-Agent.

Using the SDK User-Agent for this outbound request resolved the issue in our application:

const client = createBackendApiClient({ ...options, userAgent: USER_AGENT });

Environment

System:
    OS: macOS 27.0.1
    CPU: (15) arm64 Apple M5 Pro
    Memory: 75.17 MB / 24.00 GB
    Shell: 5.9 - /bin/zsh
  Binaries:
    Node: 23.11.0 - /opt/homebrew/bin/node
    npm: 11.19.1 - /opt/homebrew/bin/npm
    pnpm: 10.11.0 - /opt/homebrew/bin/pnpm
    bun: 1.3.9 - /Users/jandorn/.bun/bin/bun
  Browsers:
    Chrome: 155.0.8059.85
    Firefox: 144.0.2
    Safari: 27.0.1
  npmPackages:
    @clerk/backend: 3.2.2 => 3.2.2