Inbound Webhooks
One generated address per source, sitting outside the login. It verifies the signature, refuses a redelivery, files the whole exchange, and hands what arrived to a flow as flat variables read by name.
One address outside the login, and the gates behind it
200- 1The address, and whose it is
- 2Bounded before it is believed
- 3Per source, per minute
- 4Signature, or token, or neither
- 5Seen this delivery before
- 6Filed either way
- authorization
- cookie
- x-webhook-token
- x-api-key
- proxy-authorization
Product figures from the platform’s own defaults - not customer averages
How it works.
The address is generated, and it is the first secret
Twenty-four random bytes rendered URL-safe make a thirty-two character path. Which workspace it belongs to is worked out from the hostname the request arrived on, so nothing identifying you needs to travel in the body. Generating a fresh path is how an integration gets cut off.
Signature first, shared token second, and neither is also allowed
Given a signing secret, the header is compared in constant time against a hash of the exact bytes received, with a prefix on the header tolerated. Given a token instead, it is read from a header, a bearer line or the query string. Set neither and the address accepts anybody, and nothing on the form insists you set one.
Everything is bounded before any of it is believed
A declared length over the ceiling is turned away before a byte is buffered, and the stream is severed at the ceiling as well, so a chunked body cannot slip past the first check. A per-minute counter sits in the shared cache. Refusals get filed exactly like acceptances do.
A redelivery is acknowledged, not replayed
The key comes from either standard header or, where the sender offers none, from a hash of the body itself, which covers the many services that send no key at all. Keys are remembered for a day. A repeat gets the same success answer, is marked duplicate in the log, and starts nothing downstream.
Two moments in every run.
Every run passes through the same seven. Inbound Webhooks is the lit ones, and everything either side of it is a different page in this category.
- 01Trigger
the thing that happened first
- 02Enrol
how somebody gets onto it
- 03Wait
the pause, and what governs its length
- 04Branch
the fork, and which side is taken
- 05Act
the mail, the text, the task that goes out
- 06Measure
what counts as it having worked
- 07Exit
how somebody comes off it
The specifics.
8 facts- Address
- A thirty-two character generated path per source. Regenerating it is how you revoke one
- Signing
- A hash over the raw body in a signature header, compared in constant time, prefix optional
- Token fallback
- Only where no signing secret is set: a header, a bearer line or a query parameter. Set neither and the address accepts anything sent to it, and both fields are optional on the form
- Size ceiling
- One megabyte unless raised, and fifty is as high as it goes
- Rate limiting
- Per source per minute, unlimited until you name a number, and it lets traffic through if the cache is unreachable
- What a delivery can create
- A log row always. Past that, whatever flow you aim it at, which includes writing a lead. Deals and tasks are not among the things it makes
- Log retention
- None. Every delivery is kept until the address itself is deleted, and deleting it takes the log with it
- Not the same as
- This is the way in, on an address you hand to a sender. Reading and writing records from outside is the REST API
What starts this, and what it starts.
Automation is only ever a middle. These are the things that set it running and the things that run because of it.
More in Automation & Flows
13 capabilitiesSequences, dispositions and webhooks that act without being asked.
Thirteen node kinds on a canvas: send, wait, branch on behaviour, split, call task, tag, goal. Publish a version and in-flight leads keep their own place.
Enrol a lead once and the sequence carries them: sends, waits, branches and exits, with a ledger that makes a duplicate send structurally impossible.
Branch on whether they opened, clicked or replied, and on how the last call was dispositioned - so the next step answers what actually happened.
Weighted splits assigned by a deterministic hash of the enrolment, so a lead always takes the same arm no matter how often that step is run again.
Hold a lead for minutes or days between steps, clamped to the sending window you set, so that an overnight wait never lands at four in the morning.
Set the hours a sequence may send inside, as a fixed offset you enter yourself, and every wait is pushed forward into them before it is stored.
One do-not-contact roll per workspace, checked when a lead is enrolled and again inside the send, straight after that send has taken its own claim.
Drop a call step into a sequence and it raises an assigned task on the lead's owner, with the outcome the rep logs coming back as a branchable answer.
Name a linked deal as the outcome that means the sequence worked. Reaching it stamps goal met on the run and takes the branch you wired behind it.
Twenty-six behaviours attach to wrap-up codes, and twenty codes ship already pointing at one, so ending a call the right way books the follow-up.
Six event types a CRM rule fires from: stage change, field update, new record, reassignment, schedule and inactivity, agreed in four places at once.
Eight comparison operators guarding each action, combined with AND and only AND, so a rule meaning either of two things is built twice, as two rules.
A text is a step on the same canvas as the email and the call task, written into the real thread and carried out by the number it is going out from.
The rest of the platform.
Five more categories, all on the same record and the same bill. Each card names three of its capabilities, so you can tell from here whether it is worth opening.
Automation & Flows
See inbound webhooks on your own floor.
Thirty minutes, your numbers and your data. We will set inbound webhooks up live and you can decide from the thing itself rather than from this page.
14-day trial · no card · migration included