On webhook

Start a flow when an external service POSTs to this application's webhook URL.

Starts a flow when an external service POSTs to this application's webhook URL.

slug is the path the URL ends in. The shared secret is never stored in the flow — hashedSecret and secretPrefix are all that is kept, enough to verify a signature and to show an operator which secret is in use without being able to read it back.

At a glance

Module type	OnWebhook
Category	Events
Default tier	durable
Runs on	durable
Starts a flow	yes
Holds a body	no
Keeps state between runs	no
Available in	every application type

Parameters

slug

string · required · defaults to ""

The path this application's webhook URL ends in.

secretName

string | null · optional · defaults to null

What the shared secret is called, for an operator rotating it.

hashedSecret

string | null · optional · defaults to null

The secret's hash — enough to verify a signature, never enough to read it back.

secretPrefix

string | null · optional · defaults to null

The first characters of the secret, so an operator can tell which one is in use.

rotatedAt

string | null · optional · defaults to null

When the secret was last rotated.

Inputs

None.

Outputs

Port	Kind	Connects to	Description
event	event	event, json	The event envelope: {kind, at, payload}.
payload	json	json, scalar, signal	The POSTed body, parsed.
headers	json	json, scalar, signal	The request headers, for a service that signs or routes with them.

---

← All application modules