Repository navigation
feat: signed, retried webhooks #418
Description
Why
Events are pull-only today. Every serious IdP pushes user, session and auth events.
What
- Subscriptions per event type
- HMAC-signed payloads with a timestamp, retries with backoff, a dead letter view
- Admin API and console page
Done when
Apps receive signed events reliably and can verify them.
Activity
feat(hooks): post_login and pre_token login hooks as signed callouts (#…
feat(claims): static custom claims for roles and OpenID clients (#584)
feat(oidc): sign roles, permissions and custom claims into provider t…
feat(audit): stream audit events to OTLP and syslog sinks (#582)