Clerk + Express: env vars must exist at import time, then clerkMiddleware() and getAuth(req)

TL;DR

Checklist: - Run Node with --env-file=.env so variables exist before any import runs. - If you use dotenv, the dotenv.config() call must be the very first import in the entry file, before any Clerk import. - Never expose the secret key to the frontend.

app.get('/protected', async (req, res) => {
  const { isAuthenticated, userId } = getAuth(req)
  if (!isAuthenticated) {
    res.status(401).json({ error: 'Unauthorized' })
    return
  }
  const user = await clerkClient.users.getUser(userId)
  res.json({ user })
})

Steps

1. Clerk reads CLERK_PUBLISHABLE_KEY and CLERK_SECRET_KEY when its modules initialize, not per request. If your .env loads after import { clerkMiddleware } from '@clerk/express', the keys are missing and every request fails auth.
2. Checklist:

• Run Node with --env-file=.env so variables exist before any import runs.
• If you use dotenv, the dotenv.config() call must be the very first import in the entry file, before any Clerk import.
• Never expose the secret key to the frontend. Express is the backend; the secret stays server-side only.

When to use

You are seeing this: Clerk reads CLERK\PUBLISHABLE\KEY and CLERK\SECRET\KEY when its modules initialize, not per request. Use this skill when you run into "Clerk + Express: env vars must exist at import time, then clerkMiddleware() and getAuth(req)".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Clerk's Express quickstart requires env at import time (--env-file=.env), shows app.use(clerkMiddleware()) plus getAuth(req) with a manual 401, and the optional globals.d.ts type reference. Verified live at https://clerk.com/docs/expressjs/getting-started/quickstart.md on 2026-09-26.