Webhooks Json

Webhook (JSON) delivers each identity event as a signed JSON body to an HTTPS endpoint. The channel type in the console is Webhook. The body is JSON. You verify it before you trust it.

Add the channel

In the Authdog console:

1. Select the project and environment.
2. Open Notifications > Channels.
3. Select Add Channel.
4. Set Channel Type to Webhook and name the channel.
5. Paste an HTTPS URL that accepts POST with Content-Type: application/json.
6. Choose triggers, or leave the event list empty to drain every event.
7. Save and send a test.

The URL is stored as a secret and shown redacted after save. Open the channel and copy Signing secret (whsec_…). Rotate invalidates the previous secret immediately.

A 2xx is success. Anything else is retried with backoff starting at 60 seconds, for at most five attempts.

Read the JSON safely

Each delivery sets:

Verification order:

1. Read the raw request body before JSON parsing.
2. Parse t and v1 from X-Authdog-Signature.
3. Reject timestamps outside your replay window.
4. Compute HMAC-SHA256 over the bytes of t + "." + rawBody with the channel signing secret.
5. Compare digests in constant time.
6. Only then parse the JSON and branch on X-Authdog-Event-Type.

Store the delivery ID. The same logical event can arrive more than once.

Test it

1. Send the test delivery and log the raw body plus the three headers.
2. Confirm your verifier accepts that body and rejects a body you alter by one byte.
3. Trigger a sign-in in the same environment and confirm the event type matches what you subscribed to.

Repeat the channel in production with a production URL and secret. Channels do not copy between environments.

Related