Clerk

Clerk's Pro plan at $25 per month (or $20 annually) includes 50,000 monthly active users and removes Clerk branding, making it a low-cost infrastructure layer for agencies building client portals or SaaS tools. By embedding Clerk's drop-in UI components, agencies can accelerate delivery timelines and shift from one-off build fees to recurring maintenance retainers, directly increasing client lifetime value.

Clerk is a developer infrastructure layer, not a white-label resale product. Agencies should deploy it only for clients building their own SaaS applications, internal dashboards, or client portals. The Client Fit Matrix maps client maturity against two axes: technical readiness (ability to integrate SDKs) and product stage (early-stage vs. scaled). Early-stage startups with funded budgets fit the $2,700 Auth Starter Setup, a 24-hour engagement covering custom-branded UI, MFA, and session policies. Scaled clients needing multi-tenancy and SOC2 reports fit the Business plan at $300/month, where agencies can charge a retainer for ongoing configuration and security audits. Avoid deploying Clerk for clients wanting a managed identity service without their own app; that is a mismatch. The matrix prevents scope creep and aligns pricing with the client's actual need for authentication infrastructure.

The Non-Human Identity Perimeter framework reframes IAM for agencies: every AI agent, API key, and service account is an identity that must be governed with the same rigor as a human employee. As agencies deploy agents for content, reporting, and client communication, each one becomes a potential entry point. A single misconfigured credential can expose client data or trigger compliance failures. The framework urges agencies to inventory all non-human identities, assign ownership, and enforce least-privilege access. For example, when Meta's ad AI altered approved creative post-launch, it highlighted how platform agents operate outside traditional human access controls. Tools like Zluri and Securden now offer dedicated non-human identity governance, while 1Password extends vaults to AI agents. Agencies that ignore this perimeter risk client trust and regulatory penalties.

Identity Blast Radius is a framework for sizing the potential damage of a single compromised credential or misconfigured access path. For agencies, the blast radius is not just the client's data but the agency's own reputation and compliance posture. A single breach from weak credential management can collapse client trust, as the category description warns. The framework forces agencies to map every identity, human or non-human, to the resources it can reach, then measure the worst-case outcome if that identity is compromised. Consider an agency using Okta for SSO and 1Password for secrets: if a shared vault credential is exposed, the blast radius includes every client project that vault touches. The goal is to shrink the radius by enforcing least privilege, segmenting access, and rotating credentials, turning a potential catastrophe into a contained incident. Recent agentic AI incidents, where autonomous agents posted thousands of messages or altered approved creative, expand the blast radius to non-human identities, making this framework essential for modern agency security.

Adopt Clerk as a developer dependency to accelerate client builds, but never position it as a standalone resale service.

Inventory and govern every non-human identity, including AI agents and service accounts, before granting them broader access to client systems.

IF your agency builds client-facing SaaS products like portals or dashboards and needs auth in under a week, THEN buy Clerk Pro at $25/month (or $20/month annual) to get 50,000 monthly active users, MFA, and custom branding. IF you plan to resell Clerk as a standalone managed service or need white-label resale rights, THEN skip it because Clerk is a developer dependency, not a client-facing product.

A fixed-fee engagement to embed Clerk's authentication, multi-tenancy, and subscription billing into a client's web app, delivering a branded, secure user management layer in under a week.