Description

Configured OIDC prompts could be lost when a sign-up continued into enterprise SSO or used an OAuth provider inside <SignIn withSignUp>. The redirect still reached the identity provider, but it used the provider's default prompt behavior instead of the behavior requested through <SignUp oidcPrompt> or <SignIn withSignUp oidcPrompt>.

For example, oidcPrompt="login" no longer forced reauthentication and oidcPrompt="select_account" no longer requested the account chooser when the enterprise requirement appeared after email-link verification or an immediate combined-flow transfer.

Where the prompt was dropped

completeSignUpFlow already accepts oidcPrompt and forwards it to signUp.authenticateWithRedirect:

return signUp.authenticateWithRedirect({
  strategy: 'enterprise_sso',
  redirectUrl,
  redirectUrlComplete,
  continueSignUp: true,
  oidcPrompt,
});

The missing value came from two callers and one context boundary:

Most standalone sign-up steps were unaffected because useCompleteSignUpFlow already binds the prompt from sign-up context. The verification tab is different: EmailLinkVerify is shared with regular sign-in email-link verification, so sign-up-only SSO values cross that component boundary as explicit optional props.

Context ownership in the combined flow

SignInRoot creates a normalized SignUpContext for the sign-up routes rendered by <SignIn withSignUp>. It already copies the email-link redirect URL, SSO callback URL, sign-up completion URLs and unsafe metadata from sign-in configuration.

oidcPrompt now crosses that boundary in the same place. The embedded verification route, OAuth buttons and other continuation steps consequently read signUpContext.oidcPrompt, just like their standalone sign-up equivalents. This keeps the sign-up subtree internally consistent while preserving <SignIn> as the public configuration surface for the combined flow.

The change

• EmailLinkVerify accepts an optional oidcPrompt and forwards it to completeSignUpFlow.
• Standalone and combined sign-up verification routes supply the prompt from sign-up context.
• The combined flow normalizes signInContext.oidcPrompt into its synthetic sign-up context.
• Direct combined-flow transfers forward the prompt when they complete through enterprise SSO.
• Regression coverage asserts the final enterprise SSO request and the direct-transfer handoff both retain select_account.

All new fields are optional and internal to @clerk/ui. Regular sign-in email-link verification and applications without an OIDC prompt retain their existing behavior; there are no public export or core Clerk API changes.

Checklist

• pnpm test runs as expected.
• pnpm build runs as expected.
• (If applicable) JSDoc comments have been added or updated for any package exports
• (If applicable) Documentation has been updated

Type of change

• 🐛 Bug fix
• 🌟 New feature
• 🔨 Breaking change
• 📖 Refactoring / dependency upgrade / documentation
• other: