Protect sensitive account changes
A client-side account deletion or security-setting change must require recently verified credentials.
Clerk · Hook
useReverification
useReverification wraps a sensitive asynchronous action and handles session reverification when the user's credentials are no longer fresh. Clerk's default modal retries the original action after successful verification, or you can supply a custom UI handler.
How it works
Call the hook with an asynchronous sensitive-action function. If Clerk determines that the session needs reverification, it displays a modal; after successful verification, the original function is automatically retried. An optional handler can replace the default UI with a custom flow that calls complete or cancel.
Syntax
useReverification(fetcher, options?)Parameters
| Name | Type | Description |
|---|---|---|
fetcher | Fetcher extends (...args: any[]) => Promise<any> | A function that returns a promise and performs the sensitive action. |
options? | Options | Optional configuration, including onNeedsReverification for a custom UI. |
Returns
A wrapped function that runs the fetcher and coordinates reverification when required.
Key points
- Use this hook to protect client-side actions that require the authenticated user to confirm their identity again.
- The default experience prompts the user in a modal when the protected request needs fresh credentials.
- A successful check resumes the operation without requiring the caller to invoke the protected function again.
- Use the option to replace the built-in prompt with an application-owned reverification interface.
- Custom UI code receives the required verification level, lifecycle callbacks, and current-progress state.
Common mistakes
- Credentials are considered fresh for 10 minutes by default; after that window, the user must verify again.
- Supplying onNeedsReverification means your application must implement the custom verification interface.
- Calling cancel rejects the protected operation rather than retrying it.
Example: Protect a sensitive action
import { useReverification } from '@clerk/nextjs';
export function DeleteButton({ deleteAccount }: { deleteAccount: () => Promise<void> }) {
const deleteWithReverification = useReverification(deleteAccount);
return <button onClick={() => deleteWithReverification()}>Delete account</button>;
}Wrap the sensitive action with the hook; Clerk opens its reverification UI when needed and retries the action after successful verification.
When to use it
Build a custom reverification UI
The product needs branded or inline verification instead of Clerk's default modal.
Retry a protected request
A protected API call should transparently resume after the user completes verification.
Interview questions
QWhat does useReverification do?
The hook wraps a promise-returning function that represents the sensitive action. If reverification is required, Clerk shows a modal and automatically retries the original request after successful verification.
Follow-up: How would you replace Clerk's modal? Pass onNeedsReverification and render your own flow using the callback properties, calling complete when verification succeeds.
QWhat are the hook's inputs and custom-flow controls?
The fetcher is the asynchronous function being protected, and the optional options object configures the flow. The documented custom handler receives level, complete, cancel, and inProgress.
Follow-up: What should happen when the user abandons the flow? Call cancel so the original request is rejected instead of being retried.
QWhen will reverification be requested?
By default, credentials remain valid for 10 minutes after successful sign-in or reverification. Once stale, the next protected action can trigger reverification; the server-side window can be customized with the has() helper.
Follow-up: Does server-side checking alone display a verification prompt? No. Client-side reverification handling is still required for users to complete verification.
Related
onNeedsReverificationNeedsReverificationParameterscompletecancelinProgressauth.has()