Sign-In and Accounts

Clerk

What it does. Sign-in and sign-up, the invitation flow, password resets and sign-in codes, the Google and Microsoft buttons, and organizations (used for partner organizations and founder companies). The account's role and capabilities are stored in Clerk and mirrored into the platform's database by a webhook.

Why it is the record. Every page reads who is signed in from the Clerk session token, which carries the role. The platform never stores a password and never has to.

Where to look in the dashboard.

• Users: every account, their emails, when they last signed in, their metadata (role and capabilities).
• Invitations: every invitation and whether it was accepted, revoked or expired.
• Webhooks: the platform's endpoint, its delivery log, and the signing secret. Each delivery shows the response the platform gave.
• SSO Connections: the Google and Microsoft credentials in use.
• Sessions: the custom session token claim metadata must stay configured, or every member looks like they have no role.

Settings that must stay as they are. Sign-up mode restricted (invitation only). Organizations enabled with membership optional. Custom organization roles are not available on the current plan, so a partner's Manager tier is kept in membership metadata by the platform.

Email Clerk sends itself. The invitation link, sign-in codes and password resets. These are not in the platform's email log; look under the user in Clerk.

Google Cloud

What it does. One OAuth client in a Google Cloud project serves two purposes: the Continue with Google button (configured in Clerk) and the calendar connection (configured by the platform's own environment variables). Both need the project's consent screen.

Verification. Until the consent screen is verified by Google under Impact Hub Houston's own account, members see an "unverified app" warning when connecting a calendar. That is part of the Google Cloud handover.

Microsoft Entra

What it does. An app registration behind the Continue with Microsoft button and Outlook calendar access. The client id and secret are set on Clerk's Microsoft connection. Registering it under Impact Hub Houston's tenant means the consent screen shows the organization's own name.

The Webhook

Route /api/webhooks/clerk. Clerk calls it on every user, session, invitation, email, organization and membership event. The platform verifies the signature, records the delivery so a retry is harmless, and mirrors the change. On user.created it also builds the profile from the application, copies the name, and brings a partner's organization onto the platform. See How the Platform Works.

The endpoint in Clerk is subscribed to the user, session, email, organization, organization membership and organization invitation event types. If a new event type is ever added to the handler, subscribe the endpoint to it under Clerk's Webhooks page as well, or it never arrives.