Webhook automation

Every automation with the Webhook trigger gets its own URL. Point Shopify, WooCommerce, Zapier, a CRM or your own application at it, and each POST starts a run with the payload available to every node in the flow.

https://your-domain/api/webhooks/automation/{token}

No app to install and no OAuth: the token in the URL is the credential, and an optional signing secret adds HMAC verification on top of it.

Setting it up

1. Automations → open the flow → click the trigger node.
2. Set the trigger to Webhook.
3. Pick the platform — Shopify, WooCommerce, or Custom for everything else. The platform decides how the signature is checked, which header carries the event name, and where the customer sits inside the payload.
4. Press Generate to mint the URL, copy it, and paste it into the sending platform.
5. Save the automation and set it to Active. A paused automation accepts deliveries but starts nothing.

Shopify

Settings → Notifications → Webhooks → Create webhook. Choose the event (for example Order creation), set the format to JSON and paste the URL.

To have deliveries verified, copy your app's API secret key into the signing-secret field in the builder. Shopify signs the raw body with it and sends the digest in X-Shopify-Hmac-Sha256.

The topic arrives in X-Shopify-Topic (orders/create, orders/paid, …), so the event filter works without any extra configuration.

WooCommerce

WooCommerce → Settings → Advanced → Webhooks → Add webhook. Set Status to Active, choose the topic, and paste the URL as the Delivery URL.

Copy WooCommerce's Secret into the builder's signing-secret field, or press Generate a secret in the builder and paste the generated value into WooCommerce — either direction works, both sides just need the same string.

Any other platform

Choose Custom. Anything that can POST JSON (or form data) works: Zapier, Make, n8n, a billing provider, an internal service.

If the sender signs its payloads, name the header it uses and save the shared secret; HMAC-SHA256 over the raw body is accepted in hex or base64, with or without a sha256= prefix. If it does not sign anything, leave the secret empty — the URL token is then the only credential, so treat the URL as one.

Using the payload

Every field of the body becomes a token:

{{context.payload.customer.email}}
{{context.payload.order_number}}
{{context.payload.line_items.0.title}}
{{context.payload.line_items.count}}
{{context.webhook_event}}

Nested objects use dots, array items use their index, and any array also exposes .count. The same paths work in condition nodes.

Open Recent deliveries on the trigger node to see what a platform really sent — every captured payload lists its token paths, and clicking one copies the token ready to paste into a message.

Matching the contact

The automation tries to find the contact the payload is about: first by email, then by phone. The platform presets already know where those live (Shopify's customer.email, WooCommerce's billing.email, and so on). Override any field with your own dotted path when a payload is shaped differently.

Turn on Create the contact when no one matches to have the contact created from the payload — the usual choice for order and signup webhooks. Left off, a flow with no matching contact still runs, but nodes that message a person have nobody to message.

What gets skipped, and why

The builder's Recent deliveries panel records every hit, including the ones that did nothing:

Deliveries are kept for 30 days.

Event filter

Leave it empty to accept every event. Otherwise list the topics, comma separated — orders/create, orders/paid — and use a trailing * for a prefix match (orders/*). A delivery that carries no event name at all is skipped while a filter is set.

De-duplication

Shopify and WooCommerce both retry, sometimes for days. Deliveries are de-duplicated on the platform's delivery id (or a hash of the body when there is none), so a retried order does not message the customer twice.

Testing

• Replay in the deliveries panel re-runs the current flow against a payload the platform really sent — better than a made-up sample, and it skips the signature and duplicate checks.
• A GET on the webhook URL answers 200 so a platform's "test this endpoint" button succeeds without starting a run.

Troubleshooting

Nothing appears in Recent deliveries — the platform is not reaching the server. Check the URL, and that the automation still has the same token (regenerating it invalidates the old URL).

Everything shows "Bad signature" — the secret does not match. Shopify wants the app's API secret key, WooCommerce the webhook's own secret. Turning off Reject requests that are not signed accepts the deliveries while you sort it out.

Accepted, but no message went out — check the run under Automations → Runs. If the delivery has no contact, either the payload had no email or phone at the mapped path, or contact creation is off.

The queue worker must be running for accepted runs to execute. See Production deployment.