Create a webhook

POST /organizations/{org}/webhooks

Registers an endpoint. LoginWith generates its signing secret and returns it once, in this response.

Authorization

Org owner. Anyone else gets 403 forbidden.

Path parameters

Name	Type	Description
`org`	string	The organization: its id (`org_…`) or its slug. It has to be an org your token can manage (see Who can call it)

Body

Field	Type	Required	Description
`url`	string	yes	An https URL
`events`	string[]	yes	1–50 routing-key patterns, such as `tenant.`, `.deleted`, or `#` for every event

No other field is accepted.

Response

201 Created with the endpoint and its secret.

{
  "id": "whk_65f1c2a9e4b0d3f7a1c8e90d",
  "url": "https://hooks.acme.com/loginwith",
  "events": ["tenant.*", "*.deleted"],
  "active": true,
  "created_at": "2026-10-18T09:12:00.000Z",
  "secret": "…"
}

Field	Type	Description
`id`	string	`whk_…`
`url`	URL
`events`	string[]	Routing-key patterns
`active`	boolean
`created_at`	ISO date
`secret`	string	This response only

Errors

Status	`error`	When
`400`	`invalid_request`	An unknown field, or a value that fails validation. The detail names it
`403`	`forbidden`	You are not an owner of the org
`404`	`not_found`	The org does not exist, or your token cannot manage it

Example

curl -X POST https://loginwith.loginwith.dev/organizations/acme/webhooks \
  -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" \
  -d '{"url": "https://hooks.acme.com/loginwith", "events": ["tenant.*", "*.deleted"]}'