Auth0

Connect Auth0 with a Post-User-Registration Action for sign-ups, and optionally a Log Stream for bans and deletions.

Connect

1. Create the connection: {"provider": "auth0", "programId": "prg_…"}. Keep the returned secret.

2. In Auth0 open Actions → Library → Create Action → Build from scratch, trigger Post User Registration, and paste the template from the dashboard (Settings → Auth platforms → Add → Auth0), also shown below.

3. Add the Action secrets REFERALLI_WEBHOOK_URL (your webhook URL) and REFERALLI_SECRET (the connection secret), deploy, and drag the Action into the Post User Registration flow.

4. Optional, so bans and deletions follow: Monitoring → Streams → Create Stream → Custom Webhook to the same URL, Authorization Token Bearer <connection secret>, content format JSON Array.

exports.onExecutePostUserRegistration = async (event) => {
  // builds { trigger, user: { user_id, email, email_verified, name, created_at, user_metadata } },
  // signs it with x-referalli-signature: t=<unix>,v1=<HMAC of "{t}.{body}"> and POSTs it
};

The Action's body is signed with a timestamp (5-minute window). Log Stream deliveries authenticate with the bearer token; replays are harmless because each user is attributed once.

Where the referral goes

Pass window.aff.getReferral() as user_metadata when you create the user (Lock additionalSignUpFields, the /dbconnections/signup user_metadata, or your own sign-up API).

Referral context

On your sign-up page, with the tracking script loaded, window.aff.getReferral() returns the visitor's referral. Put it where this provider carries it (below), under the default keys referalli_anon_id, referalli_click_id and referalli_coupon. The older referally_* spellings are still read. Referalli never links users by email: without these keys a sign-up is not attributed.

For Auth0 the referral is read from: user.user_metadata.*.

Check it

Each webhook delivery is answered with what Referalli did per user (attributed, partnerId, matchedVia, or the reason it wasn't); signed-protocol calls take "test": true on /signups to see the answer without storing anything. Every connector is held to the same conformance suite.