Skip to main content
Connect WorkOS so enterprise auth events fire Brew automations. Welcome new SSO users, confirm password resets, mirror SCIM provisioning into Brew contacts, or notify ops the moment an SSO connection activates.

​
What You Can Do

  • Trigger automations from WorkOS events. Cover SSO + SCIM + magic-link + password reset workflows in one connection
  • Auto-sync contacts into your audience. Every WorkOS event upserts the user / directory user into Brew with workos_* custom fields you can filter and segment on
  • Sync SCIM users into Brew contacts. Directory-sync events stream user data straight into your audience without manual import
  • Confirm sensitive changes. Fire a security confirmation the moment a password reset completes
Every marketing recipient must have opted in to hear from you. Importing or syncing contact data into Brew is not permission to email it. See What You Can Send.
SCIM matters here. Directory sync provisions employees from a customer’s identity provider, and those people have not opted in to marketing email. Treat synced directory users as transactional and account-notification recipients unless they separately opted in.

​
How It Works

  1. Brew mints a unique webhook URL for your brand and you paste it into your WorkOS Dashboard.
  2. WorkOS signs every webhook with a WorkOS-Signature: t=<timestamp>,v1=<hmac> header. Brew verifies the HMAC against your per-endpoint signing secret, with a 180-second timestamp tolerance to block replays.
  3. For each verified event Brew (a) starts every Live automation whose trigger matches and (b) upserts the WorkOS user (or SCIM-provisioned directory user) into your audience with workos_* custom fields.
See How event triggers work for the conceptual flow shared by every event-source integration.

​
Setup

1

Generate your Brew webhook URL

In Brew, open Integrations, click the WorkOS card, and click Generate URL. Copy the URL Brew generates.
2

Create an endpoint in WorkOS

Open dashboard.workos.com, go to Webhooks → Create Endpoint, and paste the Brew URL into the Endpoint URL field.
3

Subscribe to the events Brew supports

Enable the user, authentication, password_reset, organization, organization_membership, dsync.user, connection, and invitation events listed below, then click Create.
4

Copy the endpoint Signing Secret

WorkOS reveals the per-endpoint signing secret on the endpoint detail page. Copy it. The value is opaque (no prefix).
5

Paste the Signing Secret into Brew

Paste the secret into the Brew connect form and click Connect. Brew verifies every webhook with the WorkOS t=<timestamp>,v1=<hmac> envelope, with a 180-second timestamp tolerance.
6

Verify it's working

Trigger an event in WorkOS (e.g. provision a test user, complete a magic-link sign-in, or run a password reset). Within a few seconds it should appear in the Manage → Recent events panel of the WorkOS integration page in Brew. If it doesn’t, recheck the signing secret in step 5.

​
Triggering Automations

Once connected, every WorkOS event below is provisioned automatically and available as a trigger in the automation builder. The Manage tab is a read-only catalogue plus a live Recent events stream, no per-event enable step. Whether an event fires is controlled by whether the bound automation is Live.

​
Supported Events

Brew supports the following 18 WorkOS events: User
  • user.created
  • user.updated
  • user.deleted
Authentication
  • authentication.email_verification_succeeded
  • authentication.password_failed
  • authentication.magic_auth_succeeded
  • password_reset.succeeded
Organization
  • organization.created
  • organization.updated
  • organization.deleted
Organization membership
  • organization_membership.created
  • organization_membership.updated
  • organization_membership.deleted
Directory sync (SCIM)
  • dsync.user.created
  • dsync.user.updated
  • dsync.user.deleted
Connection
  • connection.activated
Invitation
  • invitation.accepted
password_reset.succeeded is the canonical WorkOS event name. It lives at the top level, NOT under authentication.*. If you saw authentication.password_reset_succeeded referenced anywhere, that’s an old name no longer used.
In chat, say “Send a security confirmation when a password reset completes” and Brew will scaffold the automation with password_reset.succeeded pre-selected.

​
Common Patterns

​
Personalization

These resolve as merge tags in the email body, subject line, and preview text. Use a fallback wherever an empty value would read badly, like {{ firstName | there }}.

​
Troubleshooting

Open the canvas and confirm at least one automation bound to this event is set to Live (not Draft). The Brew integration’s Manage → Recent events panel confirms the webhook is arriving, if it isn’t there, the issue is upstream (signing secret, clock skew, wrong endpoint URL). If the event is there but no email sent, the only remaining gate is automation.published.
Clock skew between WorkOS and Brew exceeds 180 seconds. Verify your platform’s clock with date -u and re-deliver the webhook from the WorkOS Dashboard.
WorkOS uses password_reset.succeeded (top-level event), NOT authentication.password_reset_succeeded. Re-subscribe in the WorkOS endpoint to the canonical name.
Trigger a WorkOS event (e.g. provision a directory user, send yourself a magic link) and watch the Manage → Recent events panel. Build your automation as a Draft, run a test send, then publish it to Live once you’re happy.

​
Requirements

  • A WorkOS account with admin access
  • Permission to create webhook endpoints in the WorkOS Dashboard

​
Need Help?

Our team is ready to support you at every step of your journey with Brew. Choose the option that works best for you:

Search Documentation

Type in the “Ask any question” search bar at the top left to instantly find relevant documentation pages.

ChatGPT/Claude Integration

Click “Open in ChatGPT” at the top right of any page to explore it further with ChatGPT or Claude.