Webhook Trigger

Give your automation an HTTP URL that external apps, forms, and backends can call. Each accepted request starts a run with the posted payload.

{
  "customer_name": "Acme Corp",
  "amount": 4500
}

Set up and test your webhook

curl -X POST https://your-glow-webhook-url \
  -H "Content-Type: application/json" \
  -d '{"customer_name": "Acme Corp", "amount": 4500, "currency": "USD"}'

curl -X POST https://api.getglow.ai/webhook/wh_your_id \
  -H "Content-Type: application/json" \
  -d '{"customer_name":"Acme Corp","amount":4500,"currency":"USD"}'

Reading what arrived

For {"customer_name": "Acme Corp", "amount": 4500, "currency": "USD"}, pick fields from Workflow data ({{ 1.body.customer_name }}, {{ 1.body.amount }}, {{ 1.body.currency }}).

Filtering allowed HTTP methods

Tools → Start → Webhook accepts POST, GET, PUT, PATCH, DELETE, and HEAD. To reject other methods with 405 Method Not Allowed, use HTTP → New webhook request from Apps and select the allowed HTTP methods.

Locking the URL to one sender

Treat the webhook URL as a secret. Requests are unauthenticated until you set Shared Secret / Signature verification:

With Signature header left blank, only x-glow-signature is checked: a sender signing under another header name is rejected until you switch it to x-glow-signature or enter its header name in Signature header.

import crypto from "node:crypto";
 
const rawBody = JSON.stringify({ event: "order.paid", orderId: "ord_123" });
const signature = crypto
  .createHmac("sha256", process.env.WEBHOOK_SECRET)
  .update(rawBody)
  .digest("hex");
 
await fetch(process.env.GLOW_WEBHOOK_URL, {
  method: "POST",
  headers: {
    "content-type": "application/json",
    "x-glow-signature": `sha256=${signature}`,
  },
  body: rawBody,
});

import hashlib, hmac, json, os, urllib.request
 
raw_body = json.dumps({"event": "order.paid", "orderId": "ord_123"}).encode("utf-8")
sig = hmac.new(os.environ["WEBHOOK_SECRET"].encode("utf-8"), raw_body, hashlib.sha256).hexdigest()
 
req = urllib.request.Request(
    os.environ["GLOW_WEBHOOK_URL"],
    data=raw_body,
    headers={"content-type": "application/json", "x-glow-signature": f"sha256={sig}"},
    method="POST",
)
urllib.request.urlopen(req)

When Body only is off, Glow masks credential headers (authorization, proxy-authorization, cookie, set-cookie, x-api-key, x-glow-api-key) as [REDACTED]. Built-in signature headers (x-glow-signature, x-hub-signature, x-hub-signature-256) and any other header carrying the same signature (in hex or base64, with or without sha256=) are masked too. Vendor headers (stripe-signature, svix-*, x-slack-signature, x-shopify-hmac-sha256) stay readable for verification against bodyRaw in a Code editor Step.

Expand Poll execution results via API (optional) to poll results or pass an x-glow-correlation-id header.

Examples to copy

What to expect when it runs

What format to send

Send JSON (Content-Type: application/json) or form-encoded payloads. Other content types arrive as text.

Limits

What the sender gets back

Set When to respond (responseMode) to reply immediately or wait for a Step result:

In Immediately mode, returning an error status code does not cancel the run.

Duplicate deliveries

Each accepted request can start a new run. Prevent duplicates when senders retry:

• Held response modes: Send a unique x-glow-correlation-id header per event. Retries return 409 {"error": "duplicate"} without starting a second run.
• Immediately mode: Store event IDs in a Data Store (route lookups with Conditions) or serialize runs in Concurrency & queueing. Also pass an idempotency key to external write APIs.

What’s Next?

• Send custom status codes, headers, bodies, or redirects mid-run with Respond to Webhook.
• Use Parse JSON when an incoming field contains JSON as text.
• Run on a recurring schedule with the Scheduler Trigger.