WorkOS AuthKit

WorkOS user events attribute AuthKit sign-ups and follow profile changes and deletions.

Connect

1. In the WorkOS dashboard open Webhooks → Create Webhook, paste your webhook URL and select user.created, user.updated and user.deleted.

2. Create the connection with the webhook secret: {"provider": "workos", "programId": "prg_…", "secret": "…"}.

WorkOS-Signature: t=<ms>, v1=<hex> is verified with a 5-minute window.

Where the referral goes

Set the referral in the user's metadata when you create them. WorkOS user events carry no ban state; report bans with a generic user.banned event. dsync.user.deleted names a directory user, not a user id, so it is acknowledged and ignored: send user.deleted to erase.

Referral context

On your sign-up page, with the tracking script loaded, window.aff.getReferral() returns the visitor's referral. Put it where this provider carries it (below), under the default keys referalli_anon_id, referalli_click_id and referalli_coupon. The older referally_* spellings are still read. Referalli never links users by email: without these keys a sign-up is not attributed.

For WorkOS AuthKit the referral is read from: data.metadata.*.

Check it

Each webhook delivery is answered with what Referalli did per user (attributed, partnerId, matchedVia, or the reason it wasn't); signed-protocol calls take "test": true on /signups to see the answer without storing anything. Every connector is held to the same conformance suite.