Webhooks

Webhooks let you connect LoginRadius to external systems by sending a real-time HTTP POST request to a URL you specify whenever certain events occur. This lets you build event-driven apps, automate workflows, and keep data in sync across your systems.

• Real-time notifications: Your endpoint receives a payload the moment a subscribed event fires.
• Choose your events: Subscribe only to the events you care about.
• Signed payloads: Every request is HTTPS-only and signed with HMAC-SHA256 so you can verify it came from LoginRadius.

Use Cases

Here are some common ways teams use webhooks:

• Real-time data sync: Keep external systems like CRMs or analytics dashboards up to date when user profiles change.
• Workflow automation: Trigger email campaigns, provisioning flows, or other actions in response to user activity.
• Event logging: Capture logins, profile updates, and security changes for auditing or analytics.

Integration and Configuration

You can set up webhooks through the Admin Console or manage them via the API — whichever fits your workflow.

Steps to configure in the Admin Console

1. Access Webhooks: Go to Integrations > Webhooks in the Console.
2. Create a Webhook:

   • Assign a unique webhook name.

   • Select an event from the dropdown.

   • Provide a Subscribe URL where payloads will be sent.

   • Choose a Secret Name for signature generation. To add a new secret, follow this guide.

   • Choose Authentication Type:

     i. No Authentication: No credentials required

     ii. Bearer Token: Provide the Bearer Token.

     iii. Basic Authentication: Provide username and password.

   • Headers and Query Parameters: Optionally provide custom headers and/or query parameters to include in requests.

3. Save and Review: The configured webhook appears in the Configured Requests table for editing or unsubscribing.

API Integration

For dynamic setups, use the LoginRadius Webhooks API to manage subscriptions and configurations programmatically. Webhooks provide a developer-friendly approach for real-time and scalable integrations with minimal overhead.

To manage webhooks programmatically, use the Webhooks API.

Events

Events are the core triggers that activate webhooks. LoginRadius offers a broad range of events, enabling precise control over what data is shared with your systems.

Supported Events:

• User Authentication: Login, Register, ChangePassword, ResetPassword.
• Profile Management: UpdateProfile, VerifyPhoneNumber, AddEmail, RemoveEmail.
• Account Changes: BlockAccount, DeleteAccount, SetUsername.
• Custom Data: CreateCustomObject, UpdateCustomObject, DeleteCustomObject.
• Security Updates: SetPIN, ResetPIN, ChangePIN.

By subscribing only to necessary events, you can reduce unnecessary API calls and optimize server performance.

Webhook Payloads and Headers

Webhooks deliver structured payloads for each event, ensuring all relevant data is readily available for processing.

Key Components:

• Headers: Include fields like signature, host, content-type, and others for secure identification.
• Payload Body: Varies by event and includes details such as user profiles, timestamps, and field changes.

For instance:

• A Login Event payload contains user details and timestamps.
• A Profile Update Event highlights the fields that were modified.

You can use this data for workflows, backups, or analytics. Here is the sample for the WebHook payload header:

![WebHook Payload header][image1]

WebHook sample payload Body for these events can be seen by clicking on the link provided for specific events.

Login	Register	UpdateProfile	ResetPassword	ChangePassword	EmailVerification
AddEmail	RemoveEmail	BlockAccount	DeleteAccount	SetUsername	AssignRoles
UnassignRoles	SetPassword	LinkAccount	UnlinkAccount	UpdatePhoneId	VerifyPhoneNumber
CreateCustomObject	UpdateCustomObject	DeleteCustomObject	InvalidateEmailVerification	InvalidatePhoneVerification	RemovePhoneId
RemoveRoleContext	ConsentProfileUpdate	SetPIN	ResetPIN	ChangePIN

Partner IAM Events

OrgCreated	OrgUpdated	OrgDeleted	OrgRoleCreated	OrgRoleUpdated	OrgRoleDeleted
OrgConnectionCreated	OrgConnectionUpdated	OrgConnectionDeleted	OrgMembershipCreated	OrgMembershipUpdated	OrgMembershipDeleted
OrgInvitationCreated

note

Webhooks fire for individual entity events, not bulk operations. For example, deleting an entire organization only fires OrgDeleted — not individual OrgConnectionDeleted or OrgMembershipDeleted events for its children.

Security

LoginRadius enforces HTTPS and signs every payload with HMAC-SHA256. See the Webhook Security Guide for how to verify signatures on your server.

The Tenant Management -> Audit section records all changes made to webhooks, including adding new or deleting existing webhooks. For further information, please refer to our Audit Log documentation.

Limits & Constraints

Keep the following constraints in mind when creating or managing webhook subscriptions:

Constraint	Detail
Subscriptions per event	Maximum of 5 active subscriptions per event per app.
Unique target URL per event	Two subscriptions for the same event cannot share the same target URL.
HTTPS required	All target URLs must use https://. HTTP endpoints are rejected.
URL reachability	The target URL is validated for reachability at subscription creation time.

Related Resources

Related Resources

Webhook APIsWebhook Security GuideAvailable Integrations