Webhooks
Automated HTTP callbacks that notify external systems when specific events (user login, registration) occur in real-time.
What is Webhooks?
Webhooks are automated HTTP callbacks that notify external systems when specific events occur in real-time. Unlike APIs where you poll for data, webhooks push data to your endpoint immediately when an event happens. In CIAM, webhooks enable real-time integration: when a user registers, logs in, resets password, or updates profile, the identity platform sends an HTTP POST request to your configured endpoint with event details. Webhooks eliminate polling, reduce latency, and enable event-driven architectures. They're essential for syncing user data to CRMs, triggering welcome emails, updating analytics, or flagging suspicious activity.
Analogy
Think of webhooks like a mailman who automatically delivers a letter to your neighbor whenever something happens at your house. Instead of your neighbor checking your house every 5 minutes (polling), they get an instant notification when something changes.
Types and Use Cases
Common Webhook Events in CIAM:
- Authentication: UserLogin, UserLogout, LoginFailed, PasswordReset
- Profile Management: UserRegistered, ProfileUpdated, EmailVerified
- Security: MFAEnrolled, SuspiciousActivity, AccountLocked
- Administrative: UserCreated, RoleChanged, ConsentUpdated
Common Use Cases:
- CRM Sync: Update Salesforce/HubSpot when user registers or updates profile
- Marketing Automation: Trigger welcome emails, add to drip campaigns
- Security Monitoring: Send failed logins to SIEM, flag suspicious activity
- Analytics: Track user lifecycle events in Mixpanel/Amplitude
How it Works
// Webhook Payload Example: UserRegistered Event
POST https://your-app.com/webhooks/loginradius
Content-Type: application/json
X-LR-Signature: sha256=abc123... (HMAC for verification)
{
"eventType": "UserRegistered",
"timestamp": "2025-03-05T10:30:00Z",
"data": {
"userId": "user_12345",
"email": "user@example.com",
"registrationSource": "web",
"ipAddress": "203.0.113.1"
}
}Webhooks vs Polling (API Pull)
Webhooks
Polling (API Pull)
Webhooks push data in real-time (event-driven),
polling requires constant API calls to check for changes
Webhooks have lower latency and reduce API load,
polling creates delay and unnecessary API calls
Webhooks require public endpoint and retry logic,
polling is simpler but inefficient
Best Practices for Webhooks
- Verify Signatures: Always validate HMAC signatures (X-LR-Signature) to ensure webhooks are from LoginRadius
- Idempotency: Handle duplicate webhooks gracefully (same event may be sent multiple times on retry)
- Quick Response: Return 200 OK quickly (< 5 seconds); process asynchronously to avoid timeouts and retries
How LoginRadius Powers Webhooks
LoginRadius CIAM platform provides comprehensive webhook support with 40+ event types covering the entire user lifecycle. Our platform offers webhook secret management, HMAC-SHA256 signature verification, automatic retries with exponential backoff, dead-letter queues for failed deliveries, and real-time event streaming. LoginRadius also provides out-of-the-box integrations with Zapier, Tray.io, and custom endpoints for seamless no-code and custom workflows.
Resources
FAQs
Secure webhooks by: (1) Verify Signature - LoginRadius signs webhooks with HMAC; validate using your webhook secret, (2) Use HTTPS - only accept webhooks on HTTPS endpoints, (3) IP Whitelist - optionally restrict to LoginRadius IP ranges, (4) Rate Limiting - protect endpoint from abuse. LoginRadius provides webhook secrets in the admin console for signature verification.
LoginRadius implements retry logic with exponential backoff: retries at 1 min, 5 min, 15 min, 1 hour, etc. After max retries (typically 10), the webhook is moved to a dead-letter queue (DLQ) for manual reprocessing. You can view failed webhooks in the LoginRadius admin console and replay them. For critical events, implement a backup mechanism (e.g., poll API periodically as fallback).
LoginRadius supports 40+ webhook event types covering authentication (login, logout), profile management (registration, updates), security (MFA, suspicious activity), and administration (role changes). Our platform provides webhook secret management, signature verification (HMAC-SHA256), automatic retries with exponential backoff, dead-letter queues for failed deliveries, and out-of-the-box integrations with Zapier and Tray.io for no-code workflows.