1# Server Actions
2 
3Server Actions are public endpoints. Always verify auth.
4 
5## Basic Protection
6 
7```typescript
8'use server';
9import { auth } from '@clerk/nextjs/server';
10 
11export async function createPost(formData: FormData) {
12  const { isAuthenticated, userId } = await auth();
13  if (!isAuthenticated) throw new Error('Unauthorized');
14 
15  const title = formData.get('title') as string;
16  await db.posts.create({ data: { title, authorId: userId } });
17  revalidatePath('/posts');
18}
19```
20 
21## Org + Role Check (B2B)
22 
23```typescript
24'use server';
25import { auth } from '@clerk/nextjs/server';
26 
27export async function createTeamProject(formData: FormData) {
28  const { userId, orgId, orgRole } = await auth();
29  if (!userId || !orgId) throw new Error('Must be in an organization');
30  if (orgRole !== 'org:admin') throw new Error('Only admins can create projects');
31 
32  const name = formData.get('name') as string;
33  await db.projects.create({ data: { name, organizationId: orgId } });
34}
35```
36 
37## Permission Check (RBAC)
38 
39```typescript
40'use server';
41import { auth } from '@clerk/nextjs/server';
42 
43export async function deleteProject(projectId: string) {
44  const { userId, has } = await auth();
45  if (!userId) throw new Error('Unauthorized');
46 
47  const canDelete = await has({ permission: 'org:project:delete' });
48  if (!canDelete) throw new Error('Missing permission');
49 
50  await db.projects.delete({ where: { id: projectId } });
51}
52```
53 
54> **Core 2 ONLY (skip if current SDK):** `isAuthenticated` is not available. Use `if (!userId)` instead.
55 
56[Docs](https://clerk.com/docs/reference/nextjs/server-actions)
57