Auth0 Webhooks Skill

Auth0 (by Okta) does not send classic per-event webhooks. Instead you create a Custom Log Stream (HTTP) that batches tenant log events and POSTs them to your endpoint as a JSON array of log records.

When to Use This Skill

• How do I receive Auth0 webhooks / Custom Log Stream events?
• How do I secure an Auth0 log stream HTTP endpoint?
• How do I validate the Auth0 Authorization token on incoming requests?
• How do I handle batched arrays of Auth0 log events?
• Why does Auth0 keep retrying my log stream endpoint?

Verification (core)

Auth0 log streams have no HMAC signature. You secure the endpoint with a static shared secret: configure an Authorization header value on the log stream, then compare it against the incoming Authorization header on every request using a timing-safe comparison. Always serve the endpoint over HTTPS.

const crypto = require('crypto');

// Compare the incoming Authorization header against the configured token.
function verifyAuth0Token(headerValue, expectedToken) {
  if (!headerValue || !expectedToken) return false;
  const a = Buffer.from(headerValue);
  const b = Buffer.from(expectedToken);
  if (a.length !== b.length) return false;   // timingSafeEqual requires equal length
  return crypto.timingSafeEqual(a, b);
}

Then process the payload — a JSON array of log records — and return 2xx quickly. Auth0 retries on any non-2xx response, so acknowledge first and do slow work asynchronously.

For complete handlers with route wiring, batch iteration, event dispatch, and tests, see:

• examples/express/
• examples/nextjs/
• examples/fastapi/

Common Event Types

Each record's type is in event.data.type (a short log event type code):

For the full list of codes, see Auth0 Log Event Type Codes.

Environment Variables

# The value you set as the log stream's Authorization header (shared secret).
AUTH0_LOG_STREAM_TOKEN=your-long-random-secret

Local Development

# Start tunnel (no account needed)
npx hookdeck-cli listen 3000 auth0 --path /webhooks/auth0

Reference Materials

• references/overview.md - Auth0 log streams and common event codes
• references/setup.md - Create a Custom Log Stream in the Auth0 Dashboard
• references/verification.md - Authorization token validation details and gotchas