Auto‑revoke Claude Agent access when a user is offboarded with Kinde webhooks

Description and use

Auto‑revoke Claude Agent access when a user is offboarded with Kinde webhooks

Problem

When a user is offboarded, their OAuth access token remains valid, allowing an AI agent to continue acting on their behalf.

Outcome

Implementing a webhook‑driven status check before every tool call prevents offboarded users from continuing to act via the agent, closing the security gap caused by stateless OAuth tokens.

Workflow

• 1. User signs in via Kinde and receives an OAuth token.
• 2. Agent starts a task and makes tool calls based on the token’s claims.
• 3. Kinde sends a webhook when the user is suspended or deleted.
• 4. App receives the webhook and updates its internal user status to "offboarded".
• 5. Before each tool call, enforceToolCall checks the current user status via decideAccess.
• 6. If status is "offboarded", the call is refused and the agent stops acting.
• 7. The agent’s loop ends or retries with a refusal message.

Evidence

Unsurprisingly, the agent kept working on the task.

Source

A webhook tells the app when Kinde's view of a user changes, and a check runs before every single agent action

Source