fusionauth-webhooks

name	fusionauth-webhooks
description	Receive and verify FusionAuth webhooks. Use when setting up FusionAuth webhook handlers, debugging JWT signature verification, or handling authentication events like user.create, user.login.success, user.registration.create, or user.delete.
license	MIT
metadata	{"author":"hookdeck","version":"0.1.0","repository":"https://github.com/hookdeck/webhook-skills"}

FusionAuth Webhooks

When to Use This Skill

• Setting up FusionAuth webhook handlers
• Debugging JWT signature verification failures
• Understanding FusionAuth event types and payloads
• Handling user, login, registration, or group events

Essential Code (USE THIS)

FusionAuth Signature Verification (JavaScript)

FusionAuth signs webhooks with a JWT in the X-FusionAuth-Signature-JWT header. The JWT contains a request_body_sha256 claim with the SHA-256 hash of the request body.

const crypto = require('crypto');
const jose = require('jose');

// Verify FusionAuth webhook signature
async function () {
   (!signatureJwt || !hmacSecret)  ;

   {
    
     key =  ().(hmacSecret);

    
     { payload } =  jose.(signatureJwt, key, {
      : [, , ]
    });

    
     bodyHash = crypto
      .()
      .(rawBody)
      .();

    
     payload. === bodyHash;
  }  (err) {
    .(, err.);
     ;
  }
}