Clerk adds email-code fallback for allowlisted users on enterprise SSO

Clerk, the authentication provider, has added a feature called SSO bypass that lets selected users sign in with a one-time email code when their company's enterprise single sign-on connection is unavailable, according to the company's changelog entry dated September 29.

Clerk describes the problem this way: when an enterprise connection is active, users on its domains must sign in through their identity provider. If the provider goes down, or the connection breaks because a certificate expires or a setting changes, those users are locked out, including the people who need to repair the connection. Everyone not on the allowlist must continue to use SSO.

According to Clerk, an allowlisted user who enters their email address sees a "Can't use SSO?" link in the sign-in component. After confirming, they receive a code by email and get an ordinary session. Users not on the allowlist do not see the link.

The company lists several constraints. Only users with a verified email address on a domain the connection serves can be added. Clerk says it does not check whether an address still exists in the customer's identity provider, so the allowlist is not synchronized with it. Each successful bypass is recorded as a sign_in.sso_bypass.succeeded event in Application Logs.

Administrators can manage the allowlist from the connection's page in the Clerk Dashboard or through the Backend API, with or without Organizations. Organization members who hold the org:sys_entconns_sso_bypass:manage permission, which Clerk says the default Admin role includes, can manage their own Organization's list from the Security tab of the organization profile component.

Clerk says SSO bypass is available on every instance with enterprise connections. Using it requires enabling Email verification code sign-in and adding users to an allowlist.

What is confirmed and what is not: the details above are Clerk's own description of its product. This report relies on that single company source, and we found no independent coverage or customer testing. The changelog does not describe how the feature performs in a real outage or what it costs.

Why it matters: SSO outages can lock administrators out of the very settings needed to fix them, and an email-code fallback offers a recovery path. It also creates a second sign-in route that sits outside the identity provider's controls, which makes the allowlist's membership and upkeep the points for security teams to watch. Because Clerk does not verify allowlisted addresses against the identity provider, that upkeep falls to the customer.

Revised 16 October 2026: Guth re-read the original sources and rewrote this article. The earlier version remains available as revision 1.