Webhook events

Event	What it signals	Growth Rail action
`user.registration.create.complete`	User signup confirmed by provider.	Record signup proof; join to pending SDK attribution claim.

How attribution works

A verified provider event proves the signup happened — but not that the user was referred. Growth Rail completes a referral only when that event joins to the opaque attribution claim previously captured by the SDK on the referring user's device.

Identity rule: Growth Rail joins events to claims using stable IDs and opaque tokens. It never correlates users by email, name, phone number, or billing address.

Create the Growth Rail connection

Open Dashboard → Integrations → Auth, choose FusionAuth, and create a Sandbox or Production connection. Copy the generated webhook endpoint URL — you will paste it into FusionAuth in the next step.

Register the webhook in FusionAuth

In FusionAuth → Settings → Webhooks, add the copied endpoint and subscribe to user.registration.create.complete.

Return to Growth Rail and save the FusionAuth signing key or public verification material. Growth Rail encrypts and stores it — the raw value is never returned by the API after saving.

Verification tip: In Key Master, use an HMAC, RSA, or EC signing key. Paste the HMAC secret, compact JWKS JSON, or PEM public key into Growth Rail; private RSA/EC keys must remain in FusionAuth.

Security: Never commit webhook secrets to source control or log them. If a secret is compromised, rotate it in both FusionAuth and Growth Rail immediately.

Pass attribution data from your app

Pass event.user.id to Growth Rail. Scope the webhook to the intended tenant and application so directory-wide creation does not define your product signup.

// Use event.user.id from the completed registration event.
await GrowthRail.initAppUser(fusionAuthUser.id);

Verify end-to-end in test mode

Register a user into the selected application and confirm user.registration.create.complete appears as a verified delivery.

Outcome	Meaning
Completed	Signup proof and SDK attribution token matched. The referral reward has been triggered.
Awaiting attribution	The webhook signature was valid, but the SDK claim has not arrived yet — or the stable user ID did not match a pending claim. The event is held; Growth Rail completes the referral when the claim arrives.
Ignored	The event was verified but no matching attribution claim exists and the hold window has expired, or the event type is out of scope.

Provider-specific notes

Use the non-transactional registration-complete event, not tenant-wide user.create or a browser redirect.
Growth Rail validates both the signature JWT and its request_body_sha256 claim against the exact webhook body.