AuthKit Actions request verification and response signing.
Verify an incoming action request, then sign your verdict:
{:ok, action} = WorkOS.Actions.construct_action(payload, sig_header, secret)
{:ok, response} =
WorkOS.Actions.sign_response(
%{type: "authentication", verdict: "Allow"},
secret
)response.payload and response.sig form the action webhook response body.
Summary
Functions
Verifies and deserializes an Actions request into a WorkOS.EventSchema.
Signs an action response.
Verifies the signature of an Actions request.
Types
@type option() :: {:tolerance, non_neg_integer()} | {:now_ms, integer()}
Options for verification and signing.
:tolerance— maximum age of the signature timestamp, in seconds (default 30):now_ms— current Unix time in milliseconds (defaults to the system clock; injectable for tests)
Functions
@spec construct_action(String.t(), String.t(), String.t(), [option()]) :: {:ok, WorkOS.EventSchema.t()} | {:error, WorkOS.Webhooks.Signature.verification_error()}
Verifies and deserializes an Actions request into a WorkOS.EventSchema.
@spec sign_response(map(), String.t(), [option()]) :: {:ok, %{payload: String.t(), sig: String.t()}}
Signs an action response.
response is a map with:
:type—"authentication"or"user_registration":verdict—"Allow"or"Deny":error_message— optional message shown on deny
Returns {:ok, %{payload: base64_payload, sig: "t=<ms>,v1=<hex>"}}.
@spec verify_header(String.t(), String.t(), String.t(), [option()]) :: :ok | {:error, WorkOS.Webhooks.Signature.verification_error()}
Verifies the signature of an Actions request.