Create a Clerk JWT template and mint a template-scoped token for a third-party service to verify

Documented steps

1. In the Clerk Dashboard open JWT templates > New template. Start blank or from an integration preset.
2. Give the template a unique name; that exact string is what you later pass as the template parameter.
3. Set Token lifetime in seconds. Clerk documents the default as 60 seconds, which is too short for most third-party integrations, so raise it deliberately.
4. Set Token allowed clock skew in seconds. The documented default is 5 seconds.
5. Write the Claims JSON using shortcodes: {{user.id}}, {{user.first_name}}, {{user.last_name}}, {{user.primary_email_address}}, {{user.primary_phone_number}}, {{user.image_url}}, {{user.created_at}}, {{user.public_metadata}}, {{user.unsafe_metadata}}. Nested access works with dot notation, e.g. {{user.public_metadata.profile.tier}}.
6. Do not try to override azp, exp, iat, iss, jti, nbf or sub. Clerk always sets these and templates cannot replace them.
7. Client-side, request the token with await getToken({ template: '<template-name>' }) from useAuth() or the Session object. Call it before each outbound request rather than caching it yourself.
8. Server-side, use clerkClient.sessions.getToken(sessionId, templateName), which wraps POST /v1/sessions/{session_id}/tokens/{template_name}.
9. The third party verifies it like any Clerk JWT: fetch https://<your-frontend-api>/.well-known/jwks.json, verify the RS256 signature, then check exp, nbf and iss (iss is your Frontend API URL).
10. Docs: https://clerk.com/docs/guides/sessions/jwt-templates