Clerk

Point Clerk's user webhooks at Referalli: sign-ups are attributed, profile changes and bans follow, deletions erase.

Embed
Preview of the card
<a href="https://referalli.com/docs/auth-clerk"><img src="https://referalli.com/docs/_api/public/orgs/07f432f4-34b9-46a7-aaad-c0e395d2e4f9/spaces/2bf4f614-3630-4fbf-85f9-5ecafa6b7d97/pages/9ac7fa94-56c8-4b7c-95c8-7749e55dd952/social-card.svg?v=3e7ae33eec8b" alt="Clerk" width="600" height="315"></a>

Point Clerk's user webhooks at Referalli: sign-ups are attributed, profile changes and bans follow, deletions erase.

Connect

  1. In the Clerk dashboard open Configure → Webhooks → Add Endpoint and paste your connection's webhook URL (https://referalli.com/webhooks/auth/{id}).

  2. Subscribe to user.created, user.updated and user.deleted.

  3. Copy the endpoint's Signing Secret (whsec_…) and create the connection with it: {"provider": "clerk", "programId": "prg_…", "secret": "whsec_…"}. If you created the connection first, set it later with PUT /v1/auth/connections/{id}/secret.

Clerk signs with Svix (svix-id, svix-timestamp, svix-signature); deliveries more than 5 minutes old are refused.

Where the referral goes

await signUp.create({ emailAddress, password, unsafeMetadata: { ...window.aff.signupMetadata() } });

Event

What Referalli does

user.created

Attributes the sign-up (unsafe_metadata, public_metadata or private_metadata). Email verification feeds the risk policy.

user.updated

Email and name follow to their partner record; banned: true suspends it, false lifts it.

user.deleted

Erases the customer and their partner record.

Referral context

On your sign-up page, with the tracking script loaded, window.aff.getReferral() returns the visitor's referral. Put it where this provider carries it (below), under the default keys referalli_anon_id, referalli_click_id and referalli_coupon. The older referally_* spellings are still read. Referalli never links users by email: without these keys a sign-up is not attributed.

For Clerk the referral is read from: data.unsafe_metadata.*.

Check it

Each webhook delivery is answered with what Referalli did per user (attributed, partnerId, matchedVia, or the reason it wasn't); signed-protocol calls take "test": true on /signups to see the answer without storing anything. Every connector is held to the same conformance suite.

Updated