WebhookTrigger
Starts the flow when an HTTP request arrives. Every flow needs exactly one trigger.
Fields
| Field | Type | Required | What it does | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
signature | json | Optional signature check: { "scheme": "none" \ | "hmac" \ | "woocommerce" \ | "shopify" \ | "stripe" \ | "github" \ | "monobank" \ | "liqpay" \ | "wayforpay", "secret": "<name of a secret flow variable>" }. For "hmac" also "header" (default X-Signature), "algorithm" (sha256, sha1, sha512), "encoding" (hex, base64) and "prefix" such as "sha256=". The secret is the variable name, never its value, and the variable must be marked secret. |
Output
headers, query, body, method, path, timestamp
Notes
A request with a missing or wrong signature gets 401 and the flow does not run. WooCommerce signs with base64 HMAC-SHA256 in X-WC-Webhook-Signature; its unsigned test ping webhook_id=N gets 200 without a run. Monobank signs with ECDSA in X-Sign; the variable holds the merchant X-Token or the public key. Shopify: base64 HMAC-SHA256 in X-Shopify-Hmac-Sha256. Stripe: Stripe-Signature over "t.body", older than 5 minutes is rejected. GitHub: X-Hub-Signature-256, its ping gets 200 without a run. LiqPay: signature in the body field signature, the decoded data arrives as body.decoded. WayForPay: HMAC-MD5 in body.merchantSignature; the platform answers with the signed accept itself and runs the flow in the background, so a Response node does not reach WayForPay. The body is parsed by Content-Type: JSON and form-urlencoded become objects, anything else a string.