Inbound Webhooks

Inbound webhooks let external systems push data into Wexio. Any service that can POST JSON — a payment provider, your own backend, a no-code tool — can trigger a Wexio flow by hitting a unique URL.

Request Flow

External System                        Wexio
      │                                   │
      │  POST /webhooks/in/{connectionId} │
      │  Auth header (mode-specific)      │
      │  Body: { ...JSON payload... }     │
      │ ────────────────────────────────► │
      │                                   │
      │                         1. Verify authentication
      │                         2. Check payload size (≤100 KB)
      │                         3. Parse JSON
      │                         4. (Optional) Capture schema
      │                         5. Resolve the target contact
      │                         6. Find matching flow triggers
      │                         7. Start each matching flow
      │                                   │
      │  202 Accepted                     │
      │ ◄──────────────────────────────── │

Creating an Inbound Connection

From Settings → Webhooks & API, tap New connection and choose Inbound.

Give the connection a name that matches what's on the other side (e.g. "Stripe Payments", "n8n Lead Pipeline", "Backend Orders API"). Wexio generates:

• A unique URL: https://api.wexio.io/webhooks/in/{connectionId}
• A signing secret (for Shared Secret mode)

Authentication Modes

Pick an auth mode that matches what the partner system uses. Wexio supports seven modes covering 30+ SaaS providers.

Shared Secret (default)

Send the secret as the x-webhook-secret request header on every POST:

POST /webhooks/in/{connectionId}
x-webhook-secret: <your-secret>
Content-Type: application/json

{ ...payload... }

Wexio bcrypt-compares the header against the stored hash. There's no per-body signature — suitable when HTTPS is your only transport guarantee, or when replays are mitigated with X-Idempotency-Key.

Provider modes (Stripe, Slack, Svix, Paddle, Revolut)

Pick the mode, paste the signing secret from the provider's dashboard, and Wexio handles everything else — header parsing, HMAC computation, timestamp tolerance (±5 minutes), timing-safe comparison. The original signing key rotations from each provider are supported (multiple v1=… or h1=… values in one header).

Generic HMAC-SHA256

For any provider that signs the raw body with HMAC-SHA256:

One-click presets prefill these fields for GitHub, Shopify, Mailgun, Paystack, Razorpay, PagerDuty, Zendesk, HubSpot v3, Linear, Vercel, Netlify, and Bitbucket Cloud.

Not yet supported natively

See Webhooks → Integrations for the full support matrix and per-provider setup steps.

Contact Resolution

How Wexio maps an incoming payload to a contact in your organisation.

Examples:

If the path returns nothing, or the identifier doesn't match any People row, the log is tagged IDENTIFIER_NOT_FOUND and no flow runs.

Capture Schema

To make payload fields available as flow variables, Wexio learns the shape from a sample payload. This is also the step where you test that the partner is hitting the URL correctly.

How it works:

1. Tap Capture schema on the connection detail page. A 5-minute tunnel opens.
2. Trigger a real event on the partner side (or use Inject payload to paste a sample JSON manually).
3. Wexio infers the schema from that single payload — every scalar leaf becomes a variable — replaces the current schema (no merge), bumps the version, and closes the tunnel.
4. The payload used for capture is not dispatched to flows — capture is a separate path so you can experiment safely.

The Payload Schema panel shows every learned field, its inferred type, and whether it's required. Use these fields as {{webhook.<path>}} variables in any flow bound to this connection.

Inject a sample payload

If the partner is hard to trigger on demand, use Inject payload to paste JSON directly. Wexio treats it exactly like a live capture.

Bind the Connection to a Flow

Open any flow, add a Webhook Received trigger, and pick this connection. The flow will run every time a matching payload is received and a contact resolves successfully.

One connection can power many flows — the connection owns the auth and mapping; each flow chooses what to do with the payload.

Request Headers Wexio Honours

Outcomes & HTTP Responses

Every request lands a row in the history log with one of these outcomes:

Rotate the Signing Secret

Settings → Webhooks → your connection → Rotate secret. A new secret is generated and shown once. The old one stops working immediately — update the partner configuration before rotating, or accept a short window of 401s.

Stripe, Slack, Paddle, and several other providers support dual-signing during rotation — use that window on their side and paste the new secret to Wexio last.

Pause & Resume

From the connection detail page, tap Pause to stop accepting requests without deleting the connection. Paused connections return 404 TRIGGER_NOT_FOUND to every incoming request. Resume at any time.

Rules and Caveats

• Payload limit: 100 KB. Larger payloads are rejected with 413.
• Credentials are never returned to clients — the API doesn't expose the stored signing secret.
• Signature headers are not logged — x-webhook-secret, Stripe-Signature, Authorization, and similar are scrubbed from the history log on the server side before write.
• Retention: 30 days of history per connection, including auth failures for self-diagnosis.