[@clerk/react-router] SSO from sign-in with legal compliance enabled fails on complete-sign-up when calling signUp.update({ legalAccepted: true }) #8337

Summary

With legal compliance enabled, starting OAuth SSO from a custom sign-in page can lead to a continued sign-up flow that lands on a custom complete-sign-up page with missingFields = ['legal_accepted'].

Calling signUp.update({ legalAccepted: true, ... }) from that page fails with:

• network response: 405 Method Not Allowed
• UI/runtime error: Failed to execute 'json' on 'Response': Unexpected end of JSON input

This looks like a mismatch between:

• the documented support for carrying legalAccepted through SSO-related flows
• the current @clerk/react-router / future API surface
• the runtime behavior of the client signUp.update() continuation path

Environment

App stack:

• @clerk/react-router: reproduced on 3.0.12, then upgraded and still investigating on 3.1.2
• @clerk/localizations: reproduced on 4.4.0, upgraded to 4.5.2
• local installed Clerk transitives before upgrade:
  • @clerk/react: 6.2.1
  • @clerk/shared: 4.6.0
  • @clerk/backend: 3.2.8
• Clerk JS observed in requests: _clerk_js_version=6.7.1

Frontend framework:

• React Router 7.14.0
• React 19.2.5

Reproduction shape

Custom flow:

1. User starts on a custom sign-in page
2. User clicks OAuth provider (for example Google)
3. This path can create a new account if the user does not already exist
4. Legal compliance is enabled in Clerk
5. After OAuth redirect, Clerk continues sign-up and lands on custom complete-sign-up
6. signUp.missingFields includes legal_accepted
7. The page calls signUp.update({ firstName?, lastName?, legalAccepted: true, unsafeMetadata })

Example request emitted by the client:

curl 'https://needed-goose-0.clerk.accounts.dev/v1/client/sign_ups?__clerk_api_version=2025-11-10&_clerk_js_version=6.7.1&_method=PATCH&__clerk_db_jwt=...' \
  -H 'content-type: application/x-www-form-urlencoded' \
  -H 'origin: http://localhost:5173' \
  --data-raw 'first_name=Panagiotis&last_name=Plytas&legal_accepted=true&unsafe_metadata=%7B%22language%22%3A%22en%22%7D'

Response:

• 405 Method Not Allowed

Client-side result:

• Failed to execute 'json' on 'Response': Unexpected end of JSON input

Expected behavior

One of the following should work consistently:

1. signUp.update({ legalAccepted: true }) should be accepted during continued sign-up when missingFields includes legal_accepted
2. or the SDK/docs/types should clearly state that this path is unsupported and provide the supported pattern for SSO initiated from sign-in when legal compliance is enabled

Actual behavior

• The continued sign-up path requires legal_accepted
• The client update request for legal_accepted gets 405
• The SDK then throws while parsing the non-JSON / empty response body

Additional mismatch noticed

The docs for the legacy JS SignIn.authenticateWithRedirect() mention legalAccepted and continueSignUp, but the current future API/types used by @clerk/react-router do not appear to expose those fields cleanly on signIn.sso() / SignInFutureSSOParams.

That makes it unclear what the intended supported flow is for:

• starting OAuth from sign-in
• allowing the flow to create a new user
• requiring legal acceptance

Request

Can you confirm:

1. whether signUp.update({ legalAccepted: true }) is supposed to work in this continued sign-up path
2. whether this 405 is a bug/regression
3. what the recommended custom-flow pattern is for sign-in initiated SSO that may create a new user when legal compliance is enabled

If helpful, I can provide a minimal reproduction repo for React Router as well.