WorkOS webhook payload example (user.created)

WorkOS · event: user.created · content type: application/json

This is a representative sample — fake IDs, real structure. To see a payload with your data, point the provider at a capture URL (button below).

Headers

content-type: application/json
workos-signature: t=1788092049617,v1=da1dcde4857ffc36ec11afa3d75c6428dadb3a4acef5e874e83c45a505b7e169

Body

{
  "id": "event_01K3W9YQ5H8Z2M4T6R7XVBNP0D",
  "event": "user.created",
  "data": {
    "object": "user",
    "id": "user_01K3W9YQ4C2F8J6P0S5DZHTMRE",
    "email": "marcelina.davis@example.com",
    "first_name": "Marcelina",
    "last_name": "Davis",
    "email_verified": true,
    "profile_picture_url": null,
    "external_id": null,
    "metadata": {},
    "created_at": "2026-08-30T12:14:09.512Z",
    "updated_at": "2026-08-30T12:14:09.512Z"
  },
  "created_at": "2026-08-30T12:14:09.617Z"
}

Things that bite people

• This example's signature actually verifies: WorkOS-Signature: t=<ms>,v1=<hex> — hex HMAC-SHA256 over timestamp.rawBody, key = the endpoint's webhook secret from the WorkOS dashboard (sample here: hookden_workos_sample_webhook_secret). It's Stripe's exact wire format under WorkOS's header except t is in milliseconds. Try the signature debugger (WorkOS provider) or set the WorkOS scheme on a capture bin for live ✓/✗ badges.
• The milliseconds trap: code (and AI-generated snippets) that treats this as a Stripe clone usually enforces replay tolerance with now() - t < 300 — in seconds. With t in milliseconds that comparison rejects every genuine delivery (or, worse, divides by 1000 twice and accepts everything). The HMAC itself uses t verbatim, so signatures still match while your timestamp check fails — "signature valid, tolerance exceeded" is the tell. WorkOS SDKs default tolerance to 3–5 minutes.
• The header arrives lowercase. WorkOS sends WorkOS-Signature but most servers normalize to workos-signature — their docs call this out; exact-case header lookups miss it.
• Full objects, out of order. Unlike Asana/Dropbox thin pointers, data carries the complete resource, and WorkOS explicitly does not guarantee ordering (e.g. dsync.group.user_added can beat dsync.user.created). Upsert from the payload, compare the object's updated_at against what you've stored so a retried older event can't overwrite newer data, and dedupe on the event id — the same event can be delivered more than once.
• Retries: 6 attempts, exponential backoff over 3 days (any non-2xx counts as failure) — then the event is dropped; reconcile via the API afterwards. In staging, retries stop after several minutes — test-environment "lost" webhooks are usually this, and can be re-sent manually from the dashboard (which also has a Send test event button).
• Hardening: WorkOS publishes a fixed sender-IP list to allowlist, and recommends an unguessable webhook path — both work fine in front of a bin, and neither replaces signature verification. Subscribe your endpoint only to event types you use; respond 200 first, process from a queue.

Send it yourself

Reproduce this delivery against any endpoint (your handler, a bin, staging):

$ curl -X POST https://your-endpoint.example/hook \
  -H 'content-type: application/json' \
  -H 'workos-signature: t=1788092049617,v1=da1dcde4857ffc36ec11afa3d75c6428dadb3a4acef5e874e83c45a505b7e169' \
 -d '{
  "id": "event_01K3W9YQ5H8Z2M4T6R7XVBNP0D",
  "event": "user.created",
  "data": {
    "object": "user",
    "id": "user_01K3W9YQ4C2F8J6P0S5DZHTMRE",
    "email": "marcelina.davis@example.com",
    "first_name": "Marcelina",
    "last_name": "Davis",
    "email_verified": true,
    "profile_picture_url": null,
    "external_id": null,
    "metadata": {},
    "created_at": "2026-08-30T12:14:09.512Z",
    "updated_at": "2026-08-30T12:14:09.512Z"
  },
  "created_at": "2026-08-30T12:14:09.617Z"
}'

← All payload examples · Signature debugger · Docs