Clerk SAML connections now support up to five signing certificates for overlapping key rotation

Multiple certificates are available on every instance with SAML enterprise connections; existing connections keep their current certificate as the only entry until you add more.

A SAML enterprise connection now trusts up to five signing certificates at once.

Backend API: pass the full list as idp_certificates when you create⁠ or update⁠ an enterprise connection; responses include each certificate with its validity window. The single idp_certificate field keeps working, accepts a PEM bundle, and is deprecated.

Changing a connection's certificates replaces the entire list with the certificates you provide. If an update doesn't include certificates, the list stays the same.