How to protect certain routes based on user privileges?

[MrMoneyInTheBank]

Hello,

For my application, paid users can access certain routes that free users cannot. I am currently storing the user privilege in the private metadata field of the User object.

Using authMiddleware() made it easy to protect routes from users who are not signed in, but I cannot figure out how to further protect routes based on user privilege. I thought of using afterAuth() to check for user privilege but then this would run on every all routes which is not what I want.

I am using Next js with the app router. Any help would be appreciated!

[IGassmann]

Hey @MrMoneyInTheBank!

You can implement this functionality by storing the user privilege in the user's public metadata, which you can then embed in the session token as a claim. With that done, you will be able to check for the existence of the privilege in afterAuth() without performing a network request. Here are two guides on how to implement all of this:

• https://clerk.com/blog/exploring-clerk-metadata-stripe-webhooks
• https://clerk.com/docs/guides/basic-rbac

[MrMoneyInTheBank]

Thank you @IGassmann ! The second link was super helpful!