Auth & Identity
Okta Webhooks
Enterprise identity and single sign-on platform. Receive events for user lifecycle changes, sign-ins, and application/group membership changes via Event Hooks.
Connecting Okta to Hookbase
Create a source in Hookbase first — it gives you an ingest URL to paste into Okta. Then:
- 1In the Okta Admin Console, go to Workflow → Event Hooks and click "Create Event Hook"
- 2Enter a name and paste your Hookbase ingest URL as the endpoint URL
- 3Set Authentication field to exactly "Authorization" (Hookbase only checks that header name) and Authentication secret to the secret Hookbase generated for this source
- 4Don't add the same secret again as an extra custom header. It belongs only in the Authentication secret field
- 5Select the event-hook-eligible event types to subscribe to, then save the hook
- 6Click Verify on the hook. Okta sends a one-time GET with an x-okta-verification-challenge header and Hookbase answers it automatically; the hook must show Verified before Okta delivers events
Signature verification
Set the source's provider to okta and paste the signing secret. Every request is checked before the event is stored, and anything that fails is rejected rather than quietly recorded.
- Algorithm
- Shared secret in a custom header (not HMAC-signed) — Okta echoes back the exact header name/value you configure on every request
- Header
- Authorization
- Where to find the secret
- Admin Console → Workflow → Event Hooks → Create Event Hook → set Authentication field to exactly "Authorization" (Hookbase only checks that header name) and Authentication secret to the secret Hookbase generated for this source. Okta sends that value back verbatim on every request; it is not HMAC-signed.
Okta event types
8 of the events people route most often. Hookbase accepts every event Okta sends, whether or not it is listed here.
user.lifecycle.create
A new user was created
user.lifecycle.activate
A user account was activated
user.lifecycle.deactivate
A user account was deactivated
user.lifecycle.suspend
A user account was suspended
user.session.start
A user started a new session by signing in
user.account.lock
A user account was locked out (e.g. too many failed sign-in attempts)
user.mfa.factor.activate
A user activated a new MFA factor
application.user_membership.add
A user was assigned to an application
What a Okta webhook looks like
A user.session.start payload. Hookbase stores the raw body exactly as it arrived, so this is also what you get back on a replay.
{
"eventType": "com.okta.event_hook",
"eventTypeVersion": "1.0",
"cloudEventsVersion": "0.1",
"source": "https://your-org.okta.com/api/v1/eventHooks/whoo1a2b3c4d5e",
"data": {
"events": [
{
"uuid": "ec22a6d0-2837-11eb-9823-9fb8f750c5a9",
"published": "2024-01-15T10:30:00.000Z",
"eventType": "user.session.start",
"version": "0",
"severity": "INFO",
"displayMessage": "User login to Okta",
"actor": {
"id": "00u1a2b3c4d5e6f7g8h9",
"type": "User",
"alternateId": "jane.doe@example.com",
"displayName": "Jane Doe"
},
"client": {
"userAgent": {
"rawUserAgent": "Mozilla/5.0"
},
"ipAddress": "203.0.113.5",
"geographicalContext": {
"country": "United States",
"city": "Austin"
}
},
"outcome": {
"result": "SUCCESS"
},
"target": []
}
]
}
}Start receiving Okta webhooks
Create a source, paste the URL into Okta, and watch the first event arrive. The free tier includes 1,000 events a month.
Get Started Free