Stytch
Stytch user webhooks (Svix-signed) attribute sign-ups and follow updates and deletions.
Embed
<a href="https://referalli.com/docs/auth-stytch"><img src="https://referalli.com/docs/_api/public/orgs/07f432f4-34b9-46a7-aaad-c0e395d2e4f9/spaces/2bf4f614-3630-4fbf-85f9-5ecafa6b7d97/pages/2dd661a6-4631-408f-bf6d-6e81cb78716a/social-card.svg?v=3e7ae33eec8b" alt="Stytch" width="600" height="315"></a>Stytch user webhooks (Svix-signed) attribute sign-ups and follow updates and deletions.
Connect
In the Stytch dashboard open Webhooks → Add endpoint, paste your webhook URL and select the user create, update and delete events.
Copy the endpoint's signing secret (
whsec_…) and create the connection with it:{"provider": "stytch", "programId": "prg_…", "secret": "whsec_…"}.
Where the referral goes
Create users with the referral in untrusted_metadata (from the browser SDK) or trusted_metadata (from your backend), under the referalli_* keys. Trusted metadata wins when both are set.
Stytch has no ban state: delete the user, or send a generic user.banned event.
Referral context
On your sign-up page, with the tracking script loaded, window.aff.getReferral() returns the visitor's referral. Put it where this provider carries it (below), under the default keys referalli_anon_id, referalli_click_id and referalli_coupon. The older referally_* spellings are still read. Referalli never links users by email: without these keys a sign-up is not attributed.
For Stytch the referral is read from: user.untrusted_metadata.*, user.trusted_metadata.*.
Check it
Each webhook delivery is answered with what Referalli did per user (attributed, partnerId, matchedVia, or the reason it wasn't); signed-protocol calls take "test": true on /signups to see the answer without storing anything. Every connector is held to the same conformance suite.