Obelisk vs Clerk, honestly
Clerk is known for beautiful, drop-in React and Next.js UI components that make adding auth to a frontend fast. Obelisk is a passkey-first identity and security plane built around one idea: security you can prove, not just promise. This page compares the two fairly — Clerk is a genuinely good product for teams who want polished, pre-built sign-in UI in a React/Next.js app, and we say so plainly below.
The short version: if your priority is sign-in security you can check — passkey-first by default, tamper-evident receipts and a live, public security score for the Gate itself — Obelisk is built for exactly that. See the full field →
Where Clerk shines
Clerk genuinely shines at developer experience for React and Next.js: gorgeous pre-built <SignIn /> components, organizations and user-management UI out of the box, and a fast path from zero to a working sign-in screen. If your priority is shipping a polished frontend auth UI quickly in a JavaScript app, Clerk is an excellent, well-loved tool.
Side-by-side: Obelisk vs Clerk
Obelisk's column says what Obelisk does today, including what it does not do. Each Clerk cell that links a source is drawn from that page, checked on the date shown; the other Clerk cells reflect its public positioning as of October 2026. Vendor capabilities and pricing change, so verify the latest from their docs.
| Dimension | Obelisk | Clerk |
|---|---|---|
| Default auth method | Passkey-first / passwordless by default | Passwords, email codes and links, and social sign-in on every plan; passkeys and MFA on the paid plans, per Clerk's pricing page, as of October 2026 |
| Public security score for the provider itself | Yes — the Obelisk Rating, a live 0–100 score the Gate computes about itself and shows on its homepage. It rates the Gate, not your app. | We found no live public security score for Clerk itself, as of October 2026 |
| Verifiable login seal embed | Yes — a drop-in seal that shows its ✓ only on a registered address and links to a public verification page | Drop-in UI components, but not a verifiable security seal |
| Tamper-evident receipts | Hash-chained receipts for sign-ins, tokens and grants, under a signed ledger head | Standard audit/event logs, based on public docs |
| SAML 2.0 IdP | Not yet. The SAML 2.0 identity provider is built, but no SAML app can be connected on the hosted Gate. OpenID Connect sign-in works today. | SP-side: one enterprise SSO connection per app on the Pro and Business plans, more as a paid add-on, per Clerk's pricing page, as of October 2026 |
| Frontend UI components | Hosted immersive login + embeddable seal | Best-in-class React/Next.js drop-in components |
| Risk engine | No adaptive risk score decides a sign-in today. What is enforced: sensitive changes need a passkey sign-in — remembered, authenticator-code and email-link sessions are refused. The risk score on your account page is advisory. | Bot/abuse protections, based on public docs |
| Pricing model | Pay per audited passage (sign-in) | Per monthly retained user (Clerk says it does not bill per monthly-active-user), per its pricing page, as of October 2026 |
| Agent identity and tokens | Each agent is its own record in Agent Studio: its own key, held by the agent's runtime (Obelisk never receives the private key), a passkey-holding owner, and an opt-in public Proof Link that is opaque and revocable. No OAuth grant issues an access token to an agent on its own: the token endpoint grants only authorization_code and refresh_token. There is no client-credentials, token-exchange or ID-JAG grant. | Machine authentication with three token types: OAuth access tokens, M2M tokens and API keys. (source, checked 2026-10-02) |
| Third-party check of agent authorization | Registering, approving, transferring or revoking an agent writes a receipt to Obelisk's hash-chained ledger. Anyone holding a receipt's hash can fetch its position in the chain and a Merkle inclusion proof at /api/proof/<hash>, with no account. | The cited machine-authentication guide describes no record of a machine's authorization that a third party could check without Clerk. (source, checked 2026-10-02) |
| Root of trust | Self-operated root-of-trust — one accountable studio runs Obelisk on Obelisk | Managed multi-tenant cloud service, based on public positioning |
Why teams choose Obelisk
The differences below aren't cosmetic — they're structural choices that move security from "trust us" to "verify it."
- Passkey-first by default. Passwordless via WebAuthn/FIDO2 is the default path, not an add-on. The secret half of a passkey is never sent to Obelisk or to the site, so there is no password to stuff and no passkey secret in our database to steal, and the browser offers a passkey only to the site it was made for, which is what makes it phishing-resistant. The fallbacks, an emailed link or an authenticator code, can be phished like anywhere else, so they only get a limited session.
- In-place sign-in — popup, FedCM, or passkey on your origin. The redirect is optional:
response_mode=web_messageposts the code back to your page, FedCM shows an Obelisk prompt inline, and WebAuthn related origins let the passkey ceremony run on your domain with a direct grant — never an iframe, never a widened cookie. - Agent identities with public Proof Links. Agents enroll with their own runtime-held key (Obelisk never receives it), a passkey-holding owner stays accountable, and anyone can inspect the bounded live evidence at an opaque, revocable proof link. Reading a Proof Link needs no Obelisk account.
- A live public MCP tool server. Obelisk answers trust questions to the software that increasingly does the checking: read-only MCP tools at
POST /mcp, rate-limited and account-free — the same checks a human runs on the website, callable by any assistant. - A live, public security score for the Gate itself. The Obelisk Rating is the Gate's own security, scored 0–100 from hundreds of live signal points and shown on its homepage. It rates the Gate, not your app or your sign-in page.
- The verified seal embed. A drop-in login card (
obeliskgate.com/embed/seal.js) that shows its ✓ only on an address your registration names and links to a verification page at obeliskgate.com listing your registered addresses and what Obelisk Gate measured about your registration, each with when it was measured. - Tamper-evident, hash-chained receipts. Sign-ins, tokens and grants are written as hash-chained receipts, anchored under an ES256-signed ledger head you can check against our published JWKS. Save the head and its anchor count: a later count that went down, or a different head at the same count, shows the record was cut short or replaced. Consistency proofs between heads aren't published yet.
- Per-sign-in pricing. Every billed sign-in is recorded as a receipt you can check. It is not the cheapest option for sign-in alone; see /pricing.
Together they make sign-in a part of your stack you can check rather than take on trust. See the full trust case →
Frequently asked questions
Is Obelisk a Clerk alternative?
Yes. Both give you a complete sign-in experience without building auth from scratch. The difference in emphasis: Clerk leads with drop-in React/Next.js UI; Obelisk leads with passkey-first security you can check — hash-chained receipts and a live, public security score for the Gate itself. If an audit trail you can check yourself is the priority, Obelisk is the stronger fit.
Can I migrate from Clerk to Obelisk?
Yes for your apps: both speak OpenID Connect. Passwords don't carry over: each of your users creates a passkey the first time they sign in through Obelisk (while new accounts are by invitation, that first sign-in needs one). You integrate Obelisk the same way you'd integrate any OIDC identity provider — point your app at Obelisk for login and map the verified subject id to your own user records.
Does Obelisk have pre-built UI like Clerk?
Obelisk gives you a hosted, immersive sign-in experience plus a drop-in verified seal embed. It's a different shape from Clerk's React component library — Obelisk owns the secure login surface so you don't render credential UI at all.
See it for yourself
Ready to compare in practice? Integrate Obelisk · See the Gate Toll pricing · Add the verified seal · Create your account.
Still weighing options? Head back to the full comparison hub to see Obelisk against every provider at a glance.