Examples / Identity and security / Okta Event Hooks

Okta Event Hooks webhooks

User lifecycle, sign-in, group membership and application assignment events.

Events

user.lifecycle.create
user.session.start
group.user_membership.add
application.user_membership.add

Signature

No signature. Okta sends the Authorization header value you set. A one-time GET with X-Okta-Verification-Challenge verifies the endpoint; echo the value in a JSON body.

✓ A bin checks Okta Event Hooks signatures: add the the exact Authorization header value under Signature verification (Okta / Auth0 (Authorization header)).

Retries

Okta retries a failed delivery once after a short delay, then drops it.

See a retry schedule in the calculator.

Docs

developer.okta.com/docs/concepts/event-hooks/

Checked 2026-10-08. Report a change.

Sample request from Okta Event Hooksillustrative, shortened

Content-Typeapplication/jsonAuthorizationyour-shared-secretX-Okta-Request-IdXb7…

{
  "eventType": "com.okta.event_hook",
  "eventTime": "2026-10-08T06:34:00.000Z",
  "data": {
    "events": [
      {
        "uuid": "4d2a8f1e-…",
        "eventType": "user.lifecycle.create",
        "displayMessage": "Create okta user",
        "actor": { "alternateId": "admin@acme.example", "type": "User" },
        "target": [ { "alternateId": "ravi@acme.example", "type": "User" } ]
      }
    ]
  }
}

Receive Okta Event Hooks webhooks with webhooks.xyz

Create a bin. Paste its URL into Okta Event Hooks. Each request shows at once with its headers and body. Add your server as a destination, and deliveries retry when it is down. Request an invite.

More in identity and security: Auth0 Log Streams, Clerk, Plaid.