Auth webhooks

Events emitted for users, sessions, sign-ins, linked credentials, and passkey recovery.

Auth events fire under the user.* and visit.* namespaces. They cover the user lifecycle, sessions, linked credentials, and passkey recovery.

For the shared event envelope, endpoint setup, retries, and signature verification, see Setting up webhooks and Event delivery & best practices. The current list of event types is always available from the event types endpoint.

User lifecycle

user.created · object

Occurs whenever a user is created. Is a user.

user.updated · object

Occurs whenever a user is updated. Is a user.

user.deleted · object

Occurs whenever a user is deleted. Is a user.

user.merged · object

Occurs whenever two users are merged into one. Carries the surviving user and the merged-away user id.

visit.created · object

Occurs whenever a visit is created. Is a visit.

Sessions and sign-in

user.session.created · object

Occurs whenever a user session is created. Is a userSessionAndCredentials: the Session fields plus the user’s verifiedCredentials (wallets, emails, phone numbers, social accounts) at session-create time, so consumers can attribute the login without a follow-up API call.

user.session.revoked · object

Occurs whenever a user session is revoked. Is a session.

user.signin.failed · object

Occurs whenever a sign-in attempt fails.

Linked credentials

user.social.linked · object

Occurs whenever a user links a social account. Is a provider.

user.social.unlinked · object

Occurs whenever a user unlinks a social account. Is a provider.

user.passkeyRecovery.started · object

Occurs whenever a user started the passkey recovery process. Is a wallet.

user.passkeyRecovery.completed · object

Occurs whenever a user completed the passkey recovery process. Is a wallet.

user.email.unlinked is emitted when an email credential is unlinked but is not selectable in the event types catalog today.