Inbound Webhooks
One address per source, sitting outside the login. It checks the signature, refuses the same delivery twice, files every exchange, and hands what arrived to a flow you built. Generate a new address and that source is cut off.
One address outside the login, and the gates behind it
200- 1The address, and whose it is
- 2Bounded before it is believed
- 3Per source, per minute
- 4Signature, or token, or neither
- 5Seen this delivery before
- 6Filed either way
- authorization
- cookie
- x-webhook-token
- x-api-key
- proxy-authorization
Product figures from the platform’s own defaults - not customer averages
How it works.
The address is generated, and it is the first secret
Twenty-four random bytes rendered URL-safe make a thirty-two character path. Which workspace it belongs to is worked out from the hostname the request arrived on, so nothing identifying you needs to travel in the body. Generating a fresh path is how an integration gets cut off.
Signature first, shared token second, and neither is also allowed
Given a signing secret, the header is compared in constant time against a hash of the exact bytes received, with a prefix on the header tolerated. Given a token instead, it is read from a header, a bearer line or the query string. Set neither and the address accepts anybody, and nothing on the form insists you set one.
An oversized body is turned away before it is read
A declared length over the ceiling is turned away before a byte is buffered, and the stream is severed at the ceiling as well, so a chunked body cannot slip past the first check. A per-minute counter sits in the shared cache. Refusals get filed exactly like acceptances do.
The same delivery twice does not run twice
The key comes from either standard header or, where the sender offers none, from a hash of the body itself, which covers the many services that send no key at all. Keys are remembered for a day. A repeat gets the same success answer, is marked duplicate in the log, and starts nothing downstream.
Two moments in every run.
Every run passes through the same seven. Inbound Webhooks is the lit ones, and everything either side of it is a different page in this category.
- 01Trigger
the thing that happened first
- 02Enrol
how somebody gets onto it
- 03Wait
the pause, and what governs its length
- 04Branch
the fork, and which side is taken
- 05Act
the mail, the text, the task that goes out
- 06Measure
what counts as it having worked
- 07Exit
how somebody comes off it
The specifics.
8 facts- Address
- A thirty-two character generated path per source. Regenerating it is how you revoke one
- Signing
- A hash over the raw body in a signature header, compared in constant time, prefix optional
- Token fallback
- Only where no signing secret is set: a header, a bearer line or a query parameter. Set neither and the address accepts anything sent to it, and both fields are optional on the form
- Size ceiling
- One megabyte unless raised, and fifty is as high as it goes
- Rate limiting
- Per source per minute, unlimited until you name a number, and it lets traffic through if the cache is unreachable
- What a delivery can create
- A log row always. Past that, whatever flow you aim it at, which includes writing a lead. Deals and tasks are not among the things it makes
- Log retention
- None. Every delivery is kept until the address itself is deleted, and deleting it takes the log with it
- Not the same as
- This is the way in, on an address you hand to a sender. Reading and writing records from outside is the REST API
What starts this, and what it starts.
Automation is only ever a middle. These are the things that set it running and the things that run because of it.
More in Automation & Flows
13 capabilitiesSequences, dispositions and outside triggers that act without being asked.
What you draw is the thing that runs, not a picture somebody then has to build. Thirteen kinds of step, and publishing never moves a lead off their own place.
Enroll a lead once and the cadence carries them at their own pace. Nobody loses their place when the platform updates, and nobody is sent one message twice.
The next step answers something the person actually did, not something your floor guessed. Opened, clicked, replied, or how the last call was dispositioned.
Two versions of one cadence, side by side. Nobody lands on both and nobody switches halfway, because the side is decided by arithmetic on their own record.
Park a lead for minutes or days between steps. The delay you type is a floor rather than an appointment, so the sending hours can push it later, not earlier.
Nobody gets a message at ten past three in the morning. A pause coming due outside the hours you set is pushed forward before the time is ever written down.
One do-not-contact list per workspace, read on enrollment and read again inside the send, so an address added mid-cadence still stops the next message.
The phone, in the middle of a mail cadence. A rep gets a call task with their name on it, and whatever they log at hang-up decides where that lead goes next.
Stop writing to somebody who already bought. Name the deal state that means the cadence worked, and reaching it stamps the run and takes the branch behind it.
The do-not-call mark, the callback and the task happen because a rep picked the code, not because they remembered. Twenty-six behaviors, twenty codes shipped.
Six things set a CRM rule off: stage change, field update, new record, reassignment, schedule, inactivity. A filter stops it waking for everything that moves.
The check between a rule firing and an action actually running. Eight comparisons, every one an AND, so a rule covering either of two things gets built twice.
A text step on the same canvas as the mail and the call. It lands in the thread the SMS inbox reads, so the cadence and whoever answers see one conversation.
The rest of the platform.
Five more categories, all on the same record and the same bill. Each card names three of its capabilities, so you can tell from here whether it is worth opening.
Automation & Flows
See inbound webhooks on your own floor.
Thirty minutes, your numbers and your data. We will set inbound webhooks up live and you can decide from the thing itself rather than from this page.
14-day trial · no card · migration included