fusionauth-webhooks

Verify FusionAuth webhook signatures in Express, Next.js, and FastAPI.

79|11|Updated Jan 30, 2026
One-click install
npx skills add https://github.com/hookdeck/webhook-skills --skill fusionauth-webhooks
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: fusionauth-webhooks
Source: https://github.com/hookdeck/webhook-skills/tree/main/skills/fusionauth-webhooks
Command: npx skills add https://github.com/hookdeck/webhook-skills --skill fusionauth-webhooks

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill provides a secure way to receive FusionAuth webhooks and verify their signatures before processing payloads, ensuring authenticity and integrity in authentication events and user management actions.

Core Features & Use Cases

  • Signature verification using the X-FusionAuth-Signature-JWT header and the base64-encoded request_body_sha256 hash
  • Supports a broad set of FusionAuth webhook events (e.g., user.create, user.login.success, user.registration.create) across multiple runtimes (Express, Next.js, FastAPI)
  • Provides runnable examples and reference materials to accelerate integration and testing

Quick Start

  • Install and run the example apps (Express, Next.js, FastAPI) included in the repository
  • Set the environment variable FUSIONAUTH_WEBHOOK_SECRET with your FusionAuth signing key
  • Run the app and configure FusionAuth to post webhooks to your endpoint; test with a signed payload

Frequently Asked Questions about fusionauth-webhooks

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I verify FusionAuth webhooks using JWT signatures?

Verify FusionAuth webhooks by decoding the X-FusionAuth-Signature-JWT header and matching it against the base64-encoded request_body_sha256 hash. This ensures payload authenticity and integrity before processing user management events.

Can I verify FusionAuth webhook signatures in FastAPI and Express?

Yes, you can verify FusionAuth webhook signatures in FastAPI, Express, and Next.js runtimes. The Skill provides ready-to-run examples and reference materials to accelerate integration and testing across these specific platforms.

What environment variables do I need to set up FusionAuth webhook signature verification?

Set up FusionAuth webhook signature verification by configuring the FUSIONAUTH_WEBHOOK_SECRET environment variable with your FusionAuth signing key. This allows your endpoint to validate incoming webhook payloads.

What FusionAuth webhook events can I secure with signature verification?

You can secure a broad set of FusionAuth webhook events, including user.create, user.login.success, and user.registration.create. Signature verification protects the authenticity and integrity of these authentication and user management actions.

Why should I verify the JWT signature on incoming FusionAuth webhooks?

Verify the JWT signature on incoming FusionAuth webhooks to ensure payload authenticity and integrity. This prevents unauthorized or tampered requests from triggering unintended authentication events and user management actions in your application.