fix(js): Send oidcPrompt and oidcLoginHint in external account requests

[wobsoriano]

Description

The public types for user.createExternalAccount() and externalAccount.reauthorize() have accepted oidcPrompt and oidcLoginHint since they were added in #4789, but the ClerkJS resource implementations never read them, so both parameters were silently dropped from the Frontend API request. FAPI supports oidc_prompt and oidc_login_hint on both POST /v1/me/external_accounts and PATCH /v1/me/external_accounts/{id}/reauthorize.

This meant oidcPrompt: 'consent' never reached the OAuth authorization request. For Google connections needing offline access, an existing grant could be reused and return an access token without a refresh token, causing getUserOauthAccessToken to later fail with oauth_missing_refresh_token.

Fixes #9177

Checklist

• pnpm test runs as expected.
• pnpm build runs as expected.
• (If applicable) JSDoc comments have been added or updated for any package exports
• (If applicable) Documentation has been updated

Type of change

• 🐛 Bug fix
• 🌟 New feature
• 🔨 Breaking change
• 📖 Refactoring / dependency upgrade / documentation
• other:

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview	Aug 7, 2026 1:12am
swingset	Ready	Preview	Aug 7, 2026 1:12am

[changeset-bot]

🦋 Changeset detected

Latest commit: 578b164

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages

Name	Type
@clerk/clerk-js	Patch
@clerk/chrome-extension	Patch
@clerk/electron	Patch
@clerk/expo	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 6ce55f36-c389-4754-89cc-f17d1d14f7b6

📥 Commits

Reviewing files that changed from the base of the PR and between 2f24826 and a6d6381.

📒 Files selected for processing (5)

• .changeset/oidc-prompt-external-accounts.md
• packages/clerk-js/src/core/resources/ExternalAccount.ts
• packages/clerk-js/src/core/resources/User.ts
• packages/clerk-js/src/core/resources/__tests__/ExternalAccount.test.ts
• packages/clerk-js/src/core/resources/__tests__/User.test.ts

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• clerk/clerk_go (manual)
• clerk/dashboard (manual)
• clerk/accounts (manual)
• clerk/backoffice (manual)
• clerk/clerk (manual)
• clerk/clerk-docs (manual)
• clerk/cloudflare-workers (manual)
• clerk/clerk-ios (auto-detected)
• clerk/clerk-android (auto-detected)
• clerk/cli (auto-detected)

---

📝 Walkthrough

Walkthrough

User.createExternalAccount and ExternalAccount.reauthorize now serialize oidcPrompt and oidcLoginHint as oidc_prompt and oidc_login_hint. Tests verify both request payloads. A patch changeset documents the update.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the fix to send oidcPrompt and oidcLoginHint in external account requests.
Description check	✅ Passed	The description explains the parameter omission, affected APIs, expected serialization, and user impact.
Linked Issues check	✅ Passed	The implementation serializes both parameters for creation and reauthorization, satisfying issue #9177.
Out of Scope Changes check	✅ Passed	The changes are limited to request serialization, tests, and a related changeset for issue #9177.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

---

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@9354

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@9354

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@9354

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@9354

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@9354

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@9354

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@9354

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@9354

@clerk/expo-google-signin

npm i https://pkg.pr.new/@clerk/expo-google-signin@9354

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@9354

@clerk/express

npm i https://pkg.pr.new/@clerk/express@9354

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@9354

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@9354

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@9354

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@9354

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@9354

@clerk/react

npm i https://pkg.pr.new/@clerk/react@9354

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@9354

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@9354

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@9354

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@9354

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@9354

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@9354

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@9354

commit: 578b164

[github-actions]

API Changes Report

Generated by Break Check on 2026-08-07T01:11:40.258Z

Summary

Metric	Count
Packages analyzed	19
Packages with changes	0
🔴 Breaking changes	0
🟡 Non-breaking changes	0
🟢 Additions	0

No API Changes Detected

All packages have stable APIs with no detected changes.

---

Report generated by Break Check

_{Last ran on 578b164.}

[HAYASHIDAKodai]

@wobsoriano
We're hitting this in production and can confirm the behavior described in #9177 is still present as of clerk-js 6.30.1.

What we observed:

We call ExternalAccount.reauthorize({ additionalScopes: ['https://www.googleapis.com/auth/calendar.readonly'], oidcPrompt: 'consent', redirectUrl: ... }). This type-checks and our unit tests assert the param is passed.
Watching the network, the SDK sends PATCH /v1/me/external_accounts/{id}/reauthorize, but the Google authorize URL generated from it still contains prompt=select_account — prompt=consent never makes it into the OAuth request.

Why this hurts more than it looks:

Because prompt=consent never reaches Google, the consent screen is skipped on reauthorization, so Google never issues a new refresh token covering the incrementally added scope (refresh tokens are only issued on consent, and their scopes are fixed at issuance). Clerk then keeps refreshing with the original sign-in refresh token (base scopes only). The result: the access token works right after reauthorization, but ~1 hour later (access token expiry) the Backend API token endpoint returns a token whose actual grant lacks the added scope — while the reported scopes metadata still lists it — and Google returns 403 insufficientPermissions. Users are forced to "reconnect" every hour, and the reconnect can never fix itself.

This effectively makes incremental OAuth scopes unusable on web until this PR lands. Would love to see it merged — happy to test a canary. Thanks!