Webhook Trigger

Receives inbound HTTP events from external systems and starts workflow execution. Supports automatic signature verification for popular providers (Stripe, GitHub, Shopify, Clerk, Slack) or custom HMAC/static-secret verification for any webhook source.

Use Webhook Trigger when:

• An external service sends HTTP notifications to your workflow (e.g. Stripe payment events, GitHub push events)
• You want to react to events asynchronously (default) or return a synchronous response
• You need built-in signature verification for a supported provider

If you need a programmable API with multiple HTTP methods and authentication, use API Endpoint instead.

The payload (accessed as {{ webhook.* }}) shape:

When you select a named provider (Stripe, GitHub, etc.), signature verification is handled automatically — you only need to provide the signing secret as an environment variable. The verification type, header names, and algorithms are all pre-configured.

These fields appear only when provider is set to Generic / Custom:

The WEBHOOK_SECRET environment variable is required when using a named provider (Stripe, GitHub, Shopify, Clerk, Slack) or when using the Generic provider with static-secret or hmac-signature verification.

Configure it in your workspace's Environment Variables settings.

| Variable | When Required | Description | |----------|---------------|-------------| | WEBHOOK_SECRET | Named providers; Generic with verification enabled | The signing secret provided by the webhook source |

Stripe payment processing with automatic verification:

1. Set provider to Stripe
2. Set path to /stripe/events
3. Add WEBHOOK_SECRET env var with your Stripe signing secret (whsec_...)
4. In the Stripe Dashboard, point the webhook to your deployed URL

Access the event in downstream nodes:

{{ webhook.body.type }}
{{ webhook.body.data.object.amount }}
{{ webhook.body.data.object.customer }}

GitHub push events with automatic verification:

1. Set provider to GitHub
2. Set path to /github/push
3. Add WEBHOOK_SECRET env var with your GitHub webhook secret
4. In GitHub, set the webhook URL and content type to application/json

{{ webhook.body.repository.full_name }}
{{ webhook.body.commits }}
{{ webhook.headers["x-github-event"] }}

import webhook from @tensorify/webhook-trigger:4.0.0
import http_request from @tensorify/http-request:3.0.0

node trigger @tensorify/webhook-trigger:4.0.0 {
    provider = "stripe"
    path = "/stripe/events"
    method = "POST"
    responseMode = "ack-immediately"
}

node process @tensorify/http-request:3.0.0 {
    method = "POST"
    url = "https://api.example.com/process-payment"
}

trigger.payload -> process.body

• Provider vs Generic: When you select a named provider (Stripe, GitHub, etc.), the verification settings are handled automatically. You only need to provide the WEBHOOK_SECRET env var. Switch to Generic only for unsupported webhook sources.
• Response mode: Most webhook providers do not wait for a response. Keep responseMode set to ack-immediately unless you need to return a computed value (use use-workflow-response with a Return node).
• Path collisions: Each workflow has a unique base URL. The path setting is only a suffix — you cannot create conflicting routes across workflows.
• rawBody for HMAC: Signature verification uses the raw request body. If you modify or re-parse the body before verification, the signature check will fail.
• Replay protection: With HMAC verification, requests older than signatureToleranceSeconds (default 5 minutes) are rejected. Set missingTimestamp to reject for stricter security.

• Webhook Automation Guide — end-to-end webhook processing tutorial
• Deploying Workflows — how to get the webhook URL and deploy to production
• API Endpoint — programmable HTTP endpoint with multiple methods and auth
• Return — send a synchronous response from a webhook workflow
• Environment Variables — store signing secrets safely