Account security response
Temporarily prevent a compromised or suspicious account from signing in.
Clerk · Module
users.lockUser
Locks a Clerk user so they cannot sign in until the lock expires or is manually removed. The backend method accepts a user ID and returns the affected User object.
How it works
Call the Backend SDK's users.lockUser method with a Clerk user ID. It returns the updated User object, while the user remains unable to sign in until the lock expires or an administrator unlocks the account.
Syntax
function lockUser(userId: string): Promise<User>Parameters
| Name | Type | Description |
|---|---|---|
userId | string | The ID of the user to lock. |
Returns
Promise<User>
Key points
- The method changes the target user's state so Clerk blocks subsequent sign-in attempts.
- The restriction is temporary by default and can end through expiration or an explicit unlock operation.
- Administrators can change the lockout duration in the application's System settings.
- The duration setting is located in the Protect Rules area of System settings.
- The method takes a string user ID and resolves to a Clerk User object.
- Pass the Clerk user identifier for the account that should be locked.
Common mistakes
- The default lock lasts one hour; configure the duration in System settings under Protect > Rules.
- A locked user cannot sign in again until the configured lock expires or the account is manually unlocked.
Example: Lock a user
import { clerkClient } from '@clerk/backend'
const userId = 'user_123'
const user = await clerkClient.users.lockUser(userId)
console.log(user.id)Locks the specified user and logs the returned user's ID.
When to use it
Temporary user suspension
Enforce an administrative suspension without deleting the user.
Automated access restriction
Apply a lock from backend moderation or risk-detection workflows.
Interview questions
QWhat does users.lockUser do?
It locks the specified Clerk user and returns a Promise<User>. The user cannot sign in again while the lock is active.
Follow-up: Where is the default duration configured? In the application's System settings under Protect > Rules, where the lockout duration can be changed.
QWhat argument does lockUser require?
The method accepts one parameter, userId, whose type is string. This is the Clerk ID of the user to lock.
Follow-up: What resource does the SDK method act on? It is a wrapper around the Backend API endpoint POST/users/{user_id}/lock.
QHow is lockUser commonly called?
Use clerkClient.users.lockUser(userId) in backend code and await the returned promise. The resolved value is the locked user's User object.
Follow-up: What should be checked before calling it? Ensure the application obtains the intended Clerk user ID and that the call runs through the appropriate backend SDK setup.
Related
clerkClientusers.unlockUserUser