Add and manage webhooks

If you are experiencing issues with webhooks, it could be because the webhook request content-type header has changed from application/json to application/jwt. Read the full details here. We apologize for any inconvenience.

Webhooks are outbound HTTPS requests that Kinde sends when a specified event occurs. Each request is delivered to an external URL you configure.

Use Kinde webhooks to subscribe to event triggers and push event data to your other systems and applications.

Webhook limits apply if you are on the Kinde free plan. See all plans.

Webhook security

Link to this section

Webhook request payloads are signed and sent as a JSON Web Token (JWT) from Kinde.

If you’re using a library to validate JWTs, you’ll need the URL for your public JSON Web Key Set (JWKS). The JWKS file is available at https://<your_subdomain>.kinde.com/.well-known/jwks.

If you’re using a JavaScript backend, you can use the Kinde webhooks decoder to decode and verify the JWT. See the webhooks decoder section for details.

Manage webhooks in Kinde dashboard

Link to this section

Add a webhook

Link to this section

1. Go to Settings > Environment > Webhooks.
2. Select Add webhook.
3. Give the webhook a name and enter a description so its purpose is clear.
4. Enter the external URL.
5. Select the event triggers. You can choose from a number of triggers and categories. See below for definitions.

Edit a webhook

Link to this section

1. Go to Settings > Environment > Webhooks.
2. Select the webhook name to open the details window.
3. Update events and triggers.
4. Select Save.

Delete a webhook

Link to this section

1. Go to Settings > Environment > Webhooks.
2. Select the three-dot menu next to the webhook you want to delete.
3. Select Delete webhook. A confirmation message appears.
4. Confirm you want to delete the webhook.

Manage webhooks via the Kinde API

Link to this section

Everything you can do with webhooks in the Kinde dashboard, you can also do through the Kinde API using these endpoints.

• GET /api/v1/webhooks — list available webhooks
• POST /api/v1/webhooks — create a webhook
• PATCH /api/v1/webhooks/{webhook_id} — update a webhook
• DELETE /api/v1/webhooks/{webhook_id} — delete a webhook

Events can also be retrieved using:

• GET /api/v1/event_types — list available event types
• GET /api/v1/events/{event_id} — get an event by its event_id from a webhook payload

Learn more in the Kinde Management API reference.

Webhook triggers

Link to this section

Authentication webhooks

Link to this section

organization.created;
user.created;
user.authentication_failed;
user.authenticated;
subscriber.created;
access_request.created;

Passkey webhooks

Link to this section

passkey.added;
passkey.removed;

User management webhooks

Link to this section

role.created;
role.updated;
role.deleted;
permission.created;
permission.updated;
permission.deleted;
organization.updated;
organization.deleted;
user.updated;
user.deleted;

Billing webhooks

Link to this section

customer.agreement_cancelled;
customer.agreement_created;
customer.invoice_overdue;
customer.meter_usage_updated;
customer.payment_failed;
customer.payment_succeeded;
customer.plan_created;
customer.plan_assigned;
customer.plan_changed;

The user.created trigger does not fire when you import users.

Test webhooks on your local machine

Link to this section

To use webhooks, you need a publicly available URL. To test locally, use a proxy to expose your local instance on the internet.

Here are a couple of free tools to help you do this.

• localtunnel — fast and easy; we recommend using the --subdomain attribute to fix the issued subdomain.
• ngrok — for intermediate users; requires some development experience to set up.

Each of these services exposes a local port through a public URL that can be set as your webhook endpoint.

You can also use the webhook.site to check the webhook request payload and headers.

Next steps

Link to this section

• Set up webhooks using Next.js