Kinde

Kinde webhooks arrive as signed JWTs; Referalli verifies them with your business's public keys.

Connect

1. Create the connection with your JWKS document as the secret: open https://<your subdomain>.kinde.com/.well-known/jwks and paste the whole JSON: {"provider": "kinde", "programId": "prg_…", "secret": "{\"keys\":[…]}"}. If Kinde rotates its key, paste the new document with PUT /v1/auth/connections/{id}/secret.

2. In Kinde open Settings → Webhooks → Add webhook, paste your webhook URL and select user.created, user.updated and user.deleted.

Kinde posts application/jwt bodies signed RS256. Referalli checks the signature and the signed event_timestamp (5-minute window).

Where the referral goes

Kinde sign-up carries no custom data. Set the referral as user properties (referalli_anon_id, referalli_click_id, referalli_coupon) or send a generic user.created event for the same user id after sign-up. is_suspended on user.updated suspends or lifts their partner record.

Referral context

On your sign-up page, with the tracking script loaded, window.aff.getReferral() returns the visitor's referral. Put it where this provider carries it (below), under the default keys referalli_anon_id, referalli_click_id and referalli_coupon. The older referally_* spellings are still read. Referalli never links users by email: without these keys a sign-up is not attributed.

For Kinde the referral is read from: data.user.properties.*.

Check it

Each webhook delivery is answered with what Referalli did per user (attributed, partnerId, matchedVia, or the reason it wasn't); signed-protocol calls take "test": true on /signups to see the answer without storing anything. Every connector is held to the same conformance suite.