okta-webhooks

name	okta-webhooks
description	Receive and verify Okta Event Hooks. Use when setting up Okta event hook handlers, implementing the one-time verification challenge, authenticating requests with the Authorization header secret, or handling identity events like user.lifecycle.create, user.session.start, user.account.lock, or group.user_membership.add.
license	MIT
metadata	{"author":"hookdeck","version":"0.1.0","repository":"https://github.com/hookdeck/webhook-skills"}

Okta Webhooks

When to Use This Skill

• Setting up Okta Event Hook handlers
• Implementing the one-time verification challenge (GET handshake)
• Authenticating Okta webhook requests with the Authorization header secret
• Understanding Okta event types and payloads
• Debugging why Okta event hook verification or delivery is failing

How Okta Event Hooks Differ

Okta Event Hooks do not use an HMAC signature. Security relies on two things:

1. One-time verification handshake — When you register the hook, Okta sends a GET request with an x-okta-verification-challenge header. You must reply 200 with JSON {"verification": "<challenge value>"}.
2. Per-request authentication — You choose a secret string that Okta sends in the Authorization header on every event delivery (an HTTPS ). Verify it with a comparison. There is no body signature.