Docs · Integrations
Clerk
Point Clerk's webhooks at Invoance and every sign-in, membership change and role update becomes a signed audit event. The Svix signature is checked first.
Set up
Create the source
In the dashboard open Audit Logs, then Integrations, and connect Clerk. Copy the webhook URL. It is shown once and stored as a hash.
Add the endpoint in Clerk
In the Clerk Dashboard open Configure, then Webhooks, then Add endpoint, and paste the URL.
Subscribe to events
Pick events from the map below. Start with the core rows; the high-volume rows fire on every sign-in, sign-out and user change.
Paste the signing secret
Copy the endpoint's signing secret, whsec_ plus a base64 key, into the source. If Clerk rotates it, set the new value on the source; the URL stays the same.
Event map
| Clerk event | Becomes | Organization | Volume |
|---|---|---|---|
organizationMembership.created | member.added | data.organization; created with its name when new | core |
organizationMembership.deleted | member.removed | data.organization | core |
organizationMembership.updated | role.changed | data.organization | core |
organization.created | organization.created | data.id, with data.name | core |
user.created | user.created | none; org-less policy applies | core |
user.deleted | user.deleted | none; org-less policy applies | core |
session.revoked | session.revoked | data.last_active_organization_id, if set | core |
session.created | user.signed_in | data.last_active_organization_id, if set | high |
session.removed | user.signed_out | data.last_active_organization_id, if set | high |
user.updated | user.updated | none; org-less policy applies | high |
- The three membership events keep the Clerk role in metadata.role and name the organization as the target.
- session.revoked names the session id as the target; the actor is always the user.
- user.* events take the actor's name from first and last name, or the first email address.
- session.ended is not mapped: a sign-out fires both session.ended and session.removed, and mapping both would double count.
- An event type not in the map is skipped as unmapped_type, counted and never billed.
DeliveryResponse codes and skip reasons
| Auth | svix-id, svix-timestamp and svix-signature on every delivery; the timestamp must be within 300 seconds of server time. |
|---|---|
| Success | 200 {"received": true, "event_id": "aevt_..."} |
| Bad signature | 401 invalid_signature. Not counted as received. |
| Retries | Deduplicated by svix-id. A redelivery never stores a second event. |
| Size | One event per delivery, up to 64 KB; a larger event is skipped as payload_too_large. |
| Time | The envelope timestamp, unix milliseconds, becomes occurred_at. Missing or invalid falls back to the receive time. |
| Context | event_attributes.http_request.client_ip and user_agent are stored as context.location and context.user_agent. |