Auth & Identity
Stytch Webhooks
Authentication infrastructure. Receive events for user creation, authentication, sessions, and MFA.
Connecting Stytch to Hookbase
Create a source in Hookbase first — it gives you an ingest URL to paste into Stytch. Then:
- 1In the Stytch Dashboard, go to Webhooks
- 2Click "+ Add Endpoint" and enter your Hookbase ingest URL
- 3Choose the events you want to receive and click Create
- 4Open the endpoint and copy its Signing Secret (whsec_...)
- 5Paste the Signing Secret into your Hookbase source
Signature verification
Set the source's provider to stytch and paste the signing secret. Every request is checked before the event is stored, and anything that fails is rejected rather than quietly recorded.
- Algorithm
- HMAC-SHA256
- Header
- webhook-signature
- Where to find the secret
- Stytch Dashboard → Webhooks → (your endpoint) → Signing Secret (whsec_...)
Stytch event types
19 of the events people route most often. Hookbase accepts every event Stytch sends, whether or not it is listed here.
direct.user.create
Consumer: a user was created via the API or SDK
direct.user.update
Consumer: a user was updated via the API or SDK
direct.user.delete
Consumer: a user was deleted via the API or SDK
dashboard.user.create
Consumer: a user was created in the Dashboard
dashboard.user.update
Consumer: a user was updated in the Dashboard
dashboard.user.delete
Consumer: a user was deleted in the Dashboard
direct.user_device.new_device_attribute
Consumer: a new device attribute was seen for a user via the API or SDK
direct.organization.create
B2B: an organization was created via the API or SDK
direct.organization.update
B2B: an organization was updated via the API or SDK
direct.organization.delete
B2B: an organization was deleted via the API or SDK
direct.member.create
B2B: a member was created via the API or SDK
direct.member.update
B2B: a member was updated via the API or SDK
direct.member.delete
B2B: a member was deleted via the API or SDK
dashboard.member.update
B2B: a member was updated in the Dashboard
scim.member.create
B2B: a member was provisioned via SCIM
scim.member.update
B2B: a member was updated via SCIM
scim.member.delete
B2B: a member was deprovisioned via SCIM
direct.saml_connection.update
B2B: a SAML connection was updated via the API
direct.oidc_connection.update
B2B: an OIDC connection was updated via the API
What a Stytch webhook looks like
A direct.user.create payload. Hookbase stores the raw body exactly as it arrived, so this is also what you get back on a replay.
{
"action": "CREATE",
"event_id": "webhook-event-live-6f1c2d3e-4a5b-4c6d-8e7f-9a0b1c2d3e4f",
"id": "user-live-2b3c4d5e-6f7a-4b8c-9d0e-1f2a3b4c5d6e",
"object_type": "user",
"project_id": "project-live-7a8b9c0d-1e2f-4a3b-8c4d-5e6f7a8b9c0d",
"source": "DIRECT",
"timestamp": "2024-11-21T06:47:49.555247073Z",
"user": {
"biometric_registrations": [],
"created_at": "2024-11-21T06:47:49Z",
"crypto_wallets": [],
"emails": [
{
"email": "ada@example.com",
"email_id": "email-live-3c4d5e6f-7a8b-4c9d-8e0f-1a2b3c4d5e6f",
"verified": false
}
],
"external_id": "",
"is_locked": false,
"lock_created_at": null,
"lock_expires_at": null,
"name": {
"first_name": "Ada",
"last_name": "Lovelace",
"middle_name": ""
},
"password": null,
"phone_numbers": [],
"providers": [],
"status": "active",
"totps": [],
"trusted_metadata": {},
"untrusted_metadata": {},
"user_id": "user-live-2b3c4d5e-6f7a-4b8c-9d0e-1f2a3b4c5d6e",
"webauthn_registrations": []
},
"vertical": "CONSUMER",
"workspace_id": "workspace-prod-8b9c0d1e-2f3a-4b4c-9d5e-6f7a8b9c0d1e"
}Start receiving Stytch webhooks
Create a source, paste the URL into Stytch, and watch the first event arrive. The free tier includes 1,000 events a month.
Get Started Free