Keep application data synchronized
Synchronize a local user or organization record when Kinde emits a corresponding event.
Kinde · Const
Webhooks
Kinde webhooks notify your application when configured account events occur. Kinde sends event data in a JWT to your registered endpoint, which should verify, process, and acknowledge the request with HTTP 200.
How it works
A Kinde webhook connects an event trigger to an HTTPS endpoint you control. When the event occurs, Kinde sends an application/jwt request containing a JWT with event data and webhook details; your application should verify its authenticity, decode it, process the event, and return HTTP 200 to mark delivery successful.
Syntax
POST <registered-endpoint> with Content-Type: application/jwtReturns
The endpoint should return HTTP 200 to acknowledge successful delivery; otherwise Kinde may retry using its back-off policy.
Key points
- A webhook is an endpoint registration tied to a selected Kinde event.
- Events such as user.created trigger delivery to subscribed endpoints.
- Each delivery carries the event data and webhook metadata inside a JWT.
- An HTTP 200 response signals successful completion of the webhook workflow.
- Missing responses cause Kinde to retry delivery with backoff.
- Your application uses the received event data to initiate its own logic.
Common mistakes
- Returning HTTP 200 prevents Kinde from retrying that delivery, so acknowledge only after the request is safely handled or queued.
- Do not trust decoded data before verifying the webhook request's authenticity.
- Configure the receiver to accept application/jwt rather than assuming a JSON request body.
Example: Receive a Kinde webhook
import express from "express";
import jwt from "jsonwebtoken";
const app = express();
app.use(express.text({ type: "application/jwt" }));
app.post("/webhooks/kinde", (req, res) => {
const token = req.body;
const payload = jwt.decode(token);
console.log(payload);
res.sendStatus(200);
});
app.listen(3000);This endpoint accepts Kinde's JWT content type, decodes the event token, and returns HTTP 200 after handling it.
When to use it
Trigger automated workflows
Start application workflows when events such as user.created occur.
Capture event history
Store incoming event data for auditing or downstream processing.
Interview questions
QHow does a Kinde webhook delivery work?
A webhook registers an endpoint and associates it with a Kinde event. When the event occurs, Kinde calls the endpoint with a JWT containing event data and webhook details; a successful HTTP 200 completes delivery.
Follow-up: What should happen when delivery fails? Kinde retries when it fails to receive a response, using a back-off policy.
QHow should a receiver process a webhook request?
The request uses the application/jwt content type. The receiver should verify the request's authenticity, decode the JWT, and then use its event data to trigger application logic.
Follow-up: Why is decoding alone insufficient? Decoding reveals claims but does not establish that the request came from Kinde; authenticity verification must happen first.
QHow can webhooks and event types be managed programmatically?
Webhooks can be managed through the Kinde interface or API. The documented management endpoints include GET /api/v1/webhooks for listing, POST for creation, PATCH for updates, and DELETE for removal.
Follow-up: How can available event definitions be discovered? Use GET /api/v1/event_types to list available event types and their schemas.
Related
Webhooks flowWebhook request content-typeWebhooks securityWebhooks responses and retry policyGET /api/v1/webhooksGET /api/v1/event_types