Real use cases: Expanding your auth system with webhooks
Discover real-world cases of using Logto webhooks for authentication and authorization, including sending welcome emails, syncing data to your database, updating user roles/permissions in real-time, and integrating with third-party analytics.
Product & Design
With Logto webhook, you can receive real-time updates about specific events, such as user registration, sign-in, or reset password, without polling for updates continuously. When an event is triggered, Logto sends an HTTP request containing information about the event to an endpoint URL you specify. Your application can receive the request and take customized action based on the data, such as sending an email or updating a database.
There are some capabilities that you may not find directly in the Logto console, but you can consider whether you can use webhook to monitor your user behavior to achieve them.
Usage scenarios of Logto webhooks
Webhook provides unlimited possibilities for Auth systems. Here are some real-world use cases that I will give examples of:
1. Send email or notification
“Can I use Logto Email to send users a custom Welcome Email with a login link? We use Verification Code-only login, no passwords.”
While Logto’s email service doesn’t currently support direct welcome emails, this is a classic scenario for webhooks. Use the User.Created event, and when your Endpoint receives the user registration information, immediately send a welcome email to the user's email.
Similarly, notify users after role updates, inform admins about new members, or push bot messages to Slack or Discord to keep your team updated.
2. Data synchronization
“If I delete a user in the admin console, how do I sync this with other systems?”
Use the User.Deleted event to get the status change of the user being deleted and synchronize it to other systems. You can also immediately clear the user's login session, which will be beneficial for cross-app user management.
“I have several apps under my Logto tenant. I need a webhook to detect user creation, ensuring it’s handled by a specific app.”
Use the PostRegister event, and the Payload will contain AppId information, which will help you handle the personalized experience design of multiple app services.
3. Perform additional API calls
“I want to add each new user to my database, send them to a ‘Setup Your Organization’ page, and only allow organization invites for subsequent users. Can Logto support this?”
First, Data synchronization is required, to use the webhook Post.Register to add new user to your database. Then, use Logto management API to design your prompt page for setting an organization and invitation.
4. Data analysis
“Can I connect Logto to my analytics tool (Google Analytics, Umami, Plausible, etc.) to track user logins?”
If you need to analyze data related to user logins or authorizations, you can use Logto's webhook functionality. You can listen to webhooks sent by Logto and then integrate the data into third-party analytics tools.
Confirm whether you need webhooks
Step 1: Confirm if there are Webhook events you need
Webhook is divided into two categories, account-level and organization-level, all events are shown below:
To facilitate your segmentation scenarios and obtain matching data, it is divided in detail. However, if you need information from multiple events at the same time, you can select multiple events for one Webhook.
Note: Events of “User Interaction” type capture user actions within the UI, excluding admin-initiated changes. Events of “User” type encompass all user actions, including those by admins and end-users. For example, the event PostRegister refers to the user registering in the Sign-in experience, while User.Created includes all new users registered by the user in the UI interface and added by the administrator.
Step 2: Confirm whether the Request payload has the information you need to obtain
Different events carry different information, you can confirm whether the existing information can directly meet your use case needs. For example, id, username, primary email, profile, customData, identities, lastSignInAt, createdAt, applicationId, isSuspended, OrganizationId, OrganizationRoleId, OrganizationScopeId, etc. For details, please refer to Webhook request. If not, you can also use Management API to continue to obtain relevant user information.
Step 3: Combine with Management API for expanding advanced capabilities
You can also use Logto Management API to implement further management and function configuration.
Conclusion
Logto webhook events not only cover a wide range of scenarios, but also ensure secure transmission through verifying Signing key and Custom header. And you can view the Logto webhook dashboard to monitor the transmission of each webhook in the last 24 hours.