# Auth0 Webhooks

Auth0 (by Okta) does not send classic per-event webhooks. Instead you create a
Custom Log Stream (HTTP) that batches tenant log events and POSTs them to
your endpoint as a JSON array of log records.

## When to Use This Skill

* How do I receive Auth0 webhooks / Custom Log Stream events?
* How do I secure an Auth0 log stream HTTP endpoint?
* How do I validate the Auth0 Authorization token on incoming requests?
* How do I handle batched arrays of Auth0 log events?
* Why does Auth0 keep retrying my log stream endpoint?

## Verification (core)

Auth0 log streams have no HMAC signature. You secure the endpoint with a
static shared secret: configure an Authorization header value on the log
stream, then compare it against the incoming `Authorization` header on every
request using a timing-safe comparison. Always serve the endpoint over
HTTPS.

```javascript
const crypto = require('crypto');

// Compare the incoming Authorization header against the configured token.
function verifyAuth0Token(headerValue, expectedToken) {
  if (!headerValue || !expectedToken) return false;
  const a = Buffer.from(headerValue);
  const b = Buffer.from(expectedToken);
  if (a.length !== b.length) return false;   // timingSafeEqual requires equal length
  return crypto.timingSafeEqual(a, b);
}

```

Then process the payload — a JSON array of log records — and return `2xx`
quickly. Auth0 retries on any non-2xx response, so acknowledge first and do
slow work asynchronously.

> For complete handlers with route wiring, batch iteration, event dispatch, and tests, see:
> 
> * [examples/express/](https://github.com/hookdeck/webhook-skills/tree/main/skills/auth0-webhooks/examples/express/)
> * [examples/nextjs/](https://github.com/hookdeck/webhook-skills/tree/main/skills/auth0-webhooks/examples/nextjs/)
> * [examples/fastapi/](https://github.com/hookdeck/webhook-skills/tree/main/skills/auth0-webhooks/examples/fastapi/)

## Common Event Types

Each record's type is in `event.data.type` (a short log event type code):

| Code | Description |
| --- | --- |
| `s` | Success Login |
| `f` | Failed Login |
| `ss` | Success Signup |
| `fs` | Failed Signup |
| `sepft` | Success Exchange (Password for Access Token) |
| `seacft` | Success Exchange (Authorization Code for Access Token) |
| `feacft` | Failed Exchange (Authorization Code for Access Token) |
| `slo` | Success Logout |

> For the full list of codes, see [Auth0 Log Event Type Codes](https://auth0.com/docs/deploy-monitor/logs/log-event-type-codes).

## Environment Variables

```bash
# The value you set as the log stream's Authorization header (shared secret).
AUTH0_LOG_STREAM_TOKEN=your-long-random-secret

```

## Local Development

```bash
# Start tunnel (no account needed)
npx hookdeck-cli listen 3000 auth0 --path /webhooks/auth0

```

## Reference Materials

* [references/overview.md](https://github.com/hookdeck/webhook-skills/blob/main/skills/auth0-webhooks/references/overview.md) - Auth0 log streams and common event codes
* [references/setup.md](https://github.com/hookdeck/webhook-skills/blob/main/skills/auth0-webhooks/references/setup.md) - Create a Custom Log Stream in the Auth0 Dashboard
* [references/verification.md](https://github.com/hookdeck/webhook-skills/blob/main/skills/auth0-webhooks/references/verification.md) - Authorization token validation details and gotchas