Authdog
Back to journal
Product UpdatesEvents

More authentication events on notification channels

Notification channels can now receive events from more points in the authentication lifecycle.

From the changelog: Expanded authentication event notifications

Authdog Team

2 min read
Centered Authdog mark with an angled Events word plate on a grainy amber wash with dashed channel hops

Notification channels already saw some sign-in outcomes. Magic-link verify, token refresh, TOTP verify, and OAuth callback activity did not always reach the same webhooks. Those lifecycle points now forward through configured channels, and channel setup in the console is clearer.

This is the longer note behind the November 19 changelog entry.

How it works

Identity handlers call forwardEventToNotificationChannels for enabled channels on the environment. New (and related) event types include:

  • Magic-link verify — MAGIC_LINK_SIGNIN_FAILURE (invalid or expired token) and success via the post-auth side-effect path (MAGIC_LINK_SIGNIN_SUCCESS in the audit catalog)
  • Token refresh — TOKEN_REFRESH_SUCCESS and TOKEN_REFRESH_FAILURE
  • TOTP verify — TOTP_SIGNIN_SUCCESS and TOTP_SIGNIN_FAILURE
  • OAuth callback — OAUTH2_CALLBACK_SUCCESS (and sibling sign-in events) forwarded through the same channel pipeline

Forwarding is best-effort: a channel error is logged and does not fail the authentication request.

Console Notifications is where you create and test channels (saveNotificationChannel, testChannelEndpoint). Only enabled channels for that environment receive events.

Set it up

In the console, open Notifications:

  1. Add a channel (webhook or the provider the form lists).
  2. Enable it and send a test delivery.
  3. Complete magic-link verify, a token refresh, TOTP verify, or an OAuth callback on a test user.
  4. Confirm the channel received the event type you expect.

Disable the channel before pointing it at a production sink you are not ready to ingest.

Trust boundaries

A notification is a copy of an authentication outcome, not a second authenticator. Treat webhook URLs and signing secrets as credentials.

Do not assume every historical event type is subscribed; channels only see what the environment forwards after they are enabled. Delivery failure does not roll back the sign-in.

Try it

Enable a webhook, verify a magic link, and inspect the payload. The original release note is in the changelog.

More from Authdog
ShareLinkedInX