fix(js): wait up to 10s for the Device Intelligence result by default

[mwickett]

Description

ClerkJS waits for the Device Intelligence result (the Protect session token) before it sends a sign-in or sign-up. When an instance doesn't configure its own limit, ClerkJS gave up after 5 seconds and sent the request with a timeout status instead. This PR raises that default to 10 seconds.

• The ceiling on a server-configured token_timeout_ms stays at 10 seconds.
• Instances that set their own value are unaffected.
• A tab that can't take the cross-tab lock now keeps checking for the token another tab is fetching until its own deadline. Previously it gave up when the lock wait ended at about 5 seconds, which would have undercut the new default whenever two tabs load at once.

The 5-second default was chosen conservatively while Device Intelligence rolled out. Protections can now require a verified result, so a check that finishes after 5 seconds becomes a blocked sign-up. Over the last day of Chromium page loads, 2.1% of successful script loads took longer than 5 seconds and 0.6% longer than 10 seconds, so the new default covers most of that tail.

Trade-offs:

• If the check never finishes (the script is blocked or unreachable) and the user submits while it's still running, a sign-in or sign-up now waits up to 10 seconds instead of 5 before going out. Each request is capped at the deadline. One attempt can run longer, though: up to about 5 seconds waiting for another tab's lock plus the deadline. So two submits during the same slow attempt can wait about 15 seconds in total.
• After a failed attempt, the next one starts only once 30 seconds have passed since the failed attempt began. The wait doubles with each consecutive failure, up to 15 minutes. That backoff is per page, so a reload or another tab starts a fresh attempt.
• Instances that use the optional token_url mint retry it every 200 ms on errors within the deadline, so during an outage a page can make up to twice as many requests to it (about 50 instead of 25).

Ref: PROT-1231. A follow-up there covers keeping a token that arrives after the deadline.

Checklist

• pnpm test runs as expected.
• pnpm build runs as expected.
• (If applicable) JSDoc comments have been added or updated for any package exports
• (If applicable) Documentation has been updated

Type of change

• 🐛 Bug fix
• 🌟 New feature
• 🔨 Breaking change
• 📖 Refactoring / dependency upgrade / documentation
• other:

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clerk-js-sandbox	Ready	Preview	Oct 16, 2026 12:39pm UTC
swingset	Ready	Preview	Oct 16, 2026 12:39pm UTC

[changeset-bot]

🦋 Changeset detected

Latest commit: 6aefb67

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages

Name	Type
@clerk/clerk-js	Patch
@clerk/chrome-extension	Patch
@clerk/electron	Patch
@clerk/expo	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@10275

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@10275

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@10275

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@10275

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@10275

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@10275

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@10275

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@10275

@clerk/expo-biometrics

npm i https://pkg.pr.new/@clerk/expo-biometrics@10275

@clerk/expo-google-signin

npm i https://pkg.pr.new/@clerk/expo-google-signin@10275

@clerk/expo-native-components

npm i https://pkg.pr.new/@clerk/expo-native-components@10275

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@10275

@clerk/express

npm i https://pkg.pr.new/@clerk/express@10275

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@10275

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@10275

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@10275

@clerk/mosaic

npm i https://pkg.pr.new/@clerk/mosaic@10275

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@10275

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@10275

@clerk/react

npm i https://pkg.pr.new/@clerk/react@10275

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@10275

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@10275

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@10275

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@10275

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@10275

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@10275

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@10275

commit: 6aefb67