Clerk user.created webhook payload example (Svix)

Clerk (via Svix) · event: user.created · content type: application/json

This is a representative sample — fake IDs, real structure. To see a payload with your data, point the provider at a capture URL (button below).

See it live, not frozen

One click creates a free capture bin with this exact payload already in it — pretty-printed, headers inspectable, replayable to your own endpoint:

Then paste the bin's URL into Clerk (via Svix)'s webhook settings to capture a real delivery. No signup.

Headers

content-type: application/json
svix-id: msg_2hXK9vQ4jF7pLmNd0RtYw3ZbTqe
svix-timestamp: 1787990000
svix-signature: v1,+9k4qGgUe0eNATFMePclozazKGqbWR4sJiqo48EydaE=

Body

{
  "data": {
    "id": "user_2hXKa8bQw3ZbTqeLmNd0RtYvJfE",
    "object": "user",
    "first_name": "Ada",
    "last_name": "Lovelace",
    "image_url": "https://img.clerk.com/preview.png",
    "email_addresses": [
      {
        "id": "idn_2hXKb1cRx4AcUrfMnOe1SuZwKgF",
        "object": "email_address",
        "email_address": "ada@example.com",
        "verification": {
          "status": "verified",
          "strategy": "email_code"
        }
      }
    ],
    "primary_email_address_id": "idn_2hXKb1cRx4AcUrfMnOe1SuZwKgF",
    "created_at": 1787989998543,
    "updated_at": 1787989998543
  },
  "object": "event",
  "timestamp": 1787989999,
  "type": "user.created"
}

Things that bite people

This example's signature actually verifies: paste the body, the three svix-* header values, and the secret whsec_SG9va2RlbkRvY3NTYW1wbGVLZXkyMDI2IQ== into the signature debugger (Svix scheme). The MAC is base64 HMAC-SHA256 over id.timestamp.rawBody and the key is the base64-decoded part after whsec_ — using the secret string as-is is the classic failure. Real libraries also enforce a ±5-minute timestamp window, so this frozen example only passes MAC-only checks.
Timestamps mix units: data.created_at is milliseconds, the envelope timestamp and svix-timestamp are seconds.
svix-signature can hold multiple space-separated v1,… entries after a secret rotation — verify against each. Full triage: Clerk webhook verification failed.

Send it yourself

Reproduce this delivery against any endpoint (your handler, a bin, staging):

$ curl -X POST https://your-endpoint.example/hook \
  -H 'content-type: application/json' \
  -H 'svix-id: msg_2hXK9vQ4jF7pLmNd0RtYw3ZbTqe' \
  -H 'svix-timestamp: 1787990000' \
  -H 'svix-signature: v1,+9k4qGgUe0eNATFMePclozazKGqbWR4sJiqo48EydaE=' \
 -d '{
  "data": {
    "id": "user_2hXKa8bQw3ZbTqeLmNd0RtYvJfE",
    "object": "user",
    "first_name": "Ada",
    "last_name": "Lovelace",
    "image_url": "https://img.clerk.com/preview.png",
    "email_addresses": [
      {
        "id": "idn_2hXKb1cRx4AcUrfMnOe1SuZwKgF",
        "object": "email_address",
        "email_address": "ada@example.com",
        "verification": {
          "status": "verified",
          "strategy": "email_code"
        }
      }
    ],
    "primary_email_address_id": "idn_2hXKb1cRx4AcUrfMnOe1SuZwKgF",
    "created_at": 1787989998543,
    "updated_at": 1787989998543
  },
  "object": "event",
  "timestamp": 1787989999,
  "type": "user.created"
}'

← All payload examples · Related guide · Signature debugger · Docs