Use FAPI for OAuth popup callbacks

[brkalow]

OAuth popup flows currently depend on the Account Portal hostname even when an application sends all Frontend API traffic through its own proxy. That leaves a hostname dependency outside the proxy and prevents the popup flow from staying on the application's domain.

This changes Clerk.js to use the new FAPI popup callback route by default for both existing and future SignIn/SignUp flows. Clerk.js generates a random state value before starting the flow and accepts the callback message only when its origin matches the effective FAPI origin, its source is the opened popup, and its state matches. Direct FAPI and proxied FAPI URLs use the same path-building behavior.

Depends on https://github.com/clerk/clerk_go/pull/20467 being deployed before this Clerk.js version is released.

[changeset-bot]

🦋 Changeset detected

Latest commit: 0b0c9fb

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages

Name	Type
@clerk/clerk-js	Patch
@clerk/chrome-extension	Patch
@clerk/electron	Patch
@clerk/expo	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview, Comment	Jul 16, 2026 4:21am
swingset	Ready	Preview, Comment	Jul 16, 2026 4:21am

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Repository UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 3c2cc339-0372-4d6b-b3a6-3e3e4a9475d8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@9174

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@9174

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@9174

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@9174

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@9174

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@9174

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@9174

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@9174

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@9174

@clerk/express

npm i https://pkg.pr.new/@clerk/express@9174

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@9174

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@9174

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@9174

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@9174

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@9174

@clerk/react

npm i https://pkg.pr.new/@clerk/react@9174

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@9174

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@9174

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@9174

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@9174

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@9174

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@9174

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@9174

commit: 0b0c9fb