The Universal Webhook Connector
Authenticated calls to any API, inbound triggers with HMAC verification, and paginated polling reads — the connector behind every 'we integrate with X'.
This is the connector that makes 'any tool' honest. Outbound: per-record HTTP calls with basic, OAuth (auto-refresh-and-retry), API-key or bearer auth, custom headers, JSON or XML bodies, an optional JavaScript transform per record, and exponential-backoff retries. Inbound: every workflow gets a unique webhook URL secured by a secret header, with optional GitHub-style HMAC signature verification. And reads: a polling connector with three pagination strategies, cursors and incremental since-timestamps that turns any API into a scheduled data source.
Workflow triggers
Unique inbound URL per workflow
POST/PUT/DELETE to the workflow's URL with the secret code header starts the flow.
HMAC signature verification
Optional SHA-256 body signatures (configurable header, GitHub-style or raw hex, timing-safe compare) for sources that sign their calls.
Draft test capture
Unpublished workflows capture a sample payload so the designer can map fields against real data before going live.
Workflow actions
Call any API
Per-record HTTP with your auth mode, custom headers, JSON or XML payloads, an optional per-record JS transform, and 429/5xx retries with backoff.
OAuth refresh-and-retry
Expired tokens refresh automatically against your refresh URL and the call retries.
How data flows
Bidirectional by construction: any system that can send HTTP can start your workflows, and any API you can authenticate against can be written to or polled — with pagination (Link headers, next-URL paths, or page params), cursors, and incremental since-timestamps in the format your API expects.
Connection: Connection credentials stored per workspace: basic auth, OAuth with a refresh-token URL, API key under a custom header, or a bearer token.
Worked example: An internal tool with no 'integration' at all
Create a webhook connection with your internal API's bearer token.
Trigger: qualifying survey responses run the workflow.
Action: each record POSTs to your internal endpoint, reshaped by a small JS transform.
A scheduled read polls the same API nightly for changes, paginating until done.
Ready-made flow templates
Install a shipped template and adapt it — no build-from-scratch required.
Setting it up
1.
Create a webhook connection with your API's auth mode.
2.
For inbound: copy the workflow's unique URL and secret header into the source system.
3.
For reads: configure pagination and the since-parameter once; schedule it.
Frequently asked questions
What auth modes are supported?
Basic auth, OAuth with automatic refresh-and-retry, API key under a custom header name, and bearer tokens.
How are inbound webhooks secured?
Each workflow's URL requires a secret code header, with optional HMAC-SHA256 body signatures (configurable header, timing-safe comparison) on top.
Can it read APIs, not just call them?
Yes — the polling connector supports Link-header, next-URL and page/pageSize pagination plus cursors and incremental since-timestamps, making any API a scheduled data source.