Webhook protocol

Cloud may request user.disable, user.enable, or user.revoke-sessions. The application receives the command through its configured Cloud webhook and the local Own Auth instance performs the mutation.

Cloud creates a signing secret with the app. Add the webhook URL in Settings to reveal that secret once, then place it in the app's cloud() configuration. Changing the URL does not change the secret. Use Rotate secret when the credential must be replaced; the previous secret remains valid for five minutes.

Requests include a timestamp, nonce, key ID, body digest, and signature. Own Auth reserves nonces and idempotency keys before execution, accepts current and overlapping previous secrets, and returns cached terminal results for retries.