Inbound Webhooks

Inbound webhooks let external systems push data into Wexio. Any service that can POST JSON, such as a payment provider, your own backend or a no-code tool, can start a Wexio flow by calling a unique URL.

Request Flow

External System                        Wexio
      │                                   │
      │  POST /webhooks/in/{connectionId} │
      │  Auth header (mode-specific)      │
      │  Body: { ...JSON payload... }     │
      │ ────────────────────────────────► │
      │                                   │
      │                         1. Verify authentication
      │                         2. Check payload size (≤100 KB)
      │                         3. Parse JSON
      │                         4. (Optional) Capture schema
      │                         5. Resolve the target contact
      │                         6. Find matching flow triggers
      │                         7. Start each matching flow
      │                                   │
      │  202 Accepted                     │
      │ ◄──────────────────────────────── │

Creating an Inbound Connection

From Settings → Webhooks and API → Webhooks, click New connection and set Direction to Inbound.

Fill in the form:

Click Create connection. The toast says Webhook connection created. Wexio generates:

• A unique URL: https://api.wexio.io/webhooks/in/{connectionId}
• A signing secret (for Shared Secret mode)

The next screen shows the Endpoint URL and the Webhook secret, each with a copy button, and the Capture schema and Inject payload buttons.

Your plan caps how many connections you can create. See Connection Limit.

The Connection Page

Click Open on a connection in the list. The header has these buttons:

Below the header the page has the sections Authentication, Contact resolution, Payload schema, Ingest a sample payload and Used by. The connection page never shows the secret again: The current secret isn't displayed again after creation. Rotate the secret to view a new value.

Authentication Modes

Pick the auth mode your partner system uses. Set one in Authentication mode, or click a chip under Provider presets to set it for you. Later, change it with Change in the Authentication section.

Shared Secret

Send the secret as the x-webhook-secret request header on every POST:

POST /webhooks/in/{connectionId}
x-webhook-secret: <your-secret>
Content-Type: application/json

{ ...payload... }

Wexio bcrypt-compares the header against the stored hash. There is no per-body signature, so use this mode when HTTPS is your only transport guarantee or when you handle replays with X-Idempotency-Key.

Provider Presets

The New connection modal has a Provider presets section. A chip sets Authentication mode and, for HMAC presets, the header fields. You still paste the provider's signing secret.

The last group cannot be verified yet. Send those providers through a proxy, as described in Not Yet Supported Natively.

Provider Modes

Pick the mode and paste the signing secret from the provider's dashboard. Wexio handles header parsing, the signature check and timing-safe comparison. Modes that sign a timestamp (Stripe, Slack, Svix, Paddle, Revolut, HubSpot, Mailgun, Zendesk) reject requests older than 5 minutes.

Wexio accepts several signatures in one header during a secret rotation, for Svix, Revolut and PagerDuty (Generic HMAC SHA-256 reads them too).

Generic HMAC SHA-256

Use this mode for any provider that signs the raw body with HMAC-SHA256. It has no replay protection, because the signature carries no timestamp. Providers whose signature covers more than the body, or uses another hash, do not verify here. See Custom HMAC for the full setup.

The HMAC presets chips fill in these fields for GitHub, Bitbucket, Shopify, Razorpay, PagerDuty, Linear and Dub.

Not Yet Supported Natively

Wexio cannot verify these providers' signatures yet: Netlify, Tipalti, Orb, Knock, Humanloop, Intercom, Discord, SendGrid, PayPal, Wise, Paddle Classic, Apple IAP, Google Play Billing and Payoneer.

Send their events through n8n or Zapier. The proxy receives the event and forwards it to Wexio with the x-webhook-secret header, so the connection uses Shared secret (default).

See Integrations for the full list and per-provider setup steps.

Contact Resolution

Wexio maps each incoming payload to a contact in your organisation using these settings.

Examples:

If the path returns nothing, or the identifier doesn't match a contact that has a chat, the log is tagged IDENTIFIER_NOT_FOUND and no flow runs. Wexio never creates a contact from a webhook.

Capture Schema

Wexio learns the shape of your payload from a sample, so the fields become flow variables. This step also tests that the partner reaches the URL.

To capture a schema:

1. Tap Capture schema on the connection detail page. A 5-minute tunnel opens.
2. Trigger a real event on the partner side (or use Inject payload to paste a sample JSON manually).
3. Wexio infers the schema from that single payload - every scalar leaf becomes a variable - replaces the current schema (no merge), bumps the version, and closes the tunnel.
4. The payload used for capture is not dispatched to flows - capture is a separate path so you can experiment safely.

The Payload Schema panel shows every learned field, its inferred type and whether it is required. Use these fields as {{webhook.<path>}} variables in any flow bound to this connection.

Inject a Sample Payload

If you cannot trigger the partner on demand, use Inject payload to paste JSON directly. Wexio treats it like a live capture.

Bind the Connection to a Flow

Open any flow, add a Webhook Received trigger (Pro and Enterprise plans), and pick this connection. The flow must be published. It runs each time a matching payload arrives and a contact resolves.

One connection can serve many flows. The connection owns the auth and mapping, and each flow decides what to do with the payload.

Request Headers

Outcomes & HTTP Responses

Every request lands a row in the history log with one of these outcomes:

The endpoint answers only 202, 401, 413 or 400. The errorCode field in the JSON body tells the 400 cases apart.

Rotate the Signing Secret

Settings → Webhooks and API → Webhooks → your connection, then the ... menu in the header and Rotate secret. The menu item exists on inbound connections only. Confirm in Rotate webhook secret? with Rotate secret. The dialog warns that the current secret stops working immediately and that external systems using it get 401 Unauthorized. Rotation generates a new x-webhook-secret for Shared secret mode and shows it once as New secret (Copy it now - we don't show secrets again.), then the toast says Secret rotated. Update your external systems. The connection page never shows it again. The old one stops working immediately, so update the partner configuration first or accept a short window of 401s.

Stripe, Slack, Paddle, Revolut, PagerDuty and several other providers support dual-signing during rotation. Use that window on their side and paste the new secret into Wexio last, with Change under Authentication.

Pause & Resume

To stop accepting requests without deleting the connection, click Pause on the connection detail page. A paused connection returns 400 with errorCode: TRIGGER_NOT_FOUND to every request. You can resume at any time.

Change Authentication

In the Authentication section, click Change to open Change authentication. Pick the Authentication mode (or a provider chip), then paste the Signing secret from your provider. For Generic HMAC SHA-256, also set the Signature header name, Encoding and the optional Header prefix. The stored secret is never shown again: leave the field empty to keep it, or paste a new value to replace it. Click Save changes; a successful change shows Authentication updated.

When you create a connection in a provider mode, the Signing secret is required: without it you see Paste the signing secret from your provider.

Delete a Connection

Open the ... menu and click Delete, then Delete connection in Delete webhook connection?. The sender starts receiving 400 with errorCode: TRIGGER_NOT_FOUND. If flows use the connection, the dialog warns that their webhook triggers stop firing. The toast says Webhook connection deleted.

Rules and Caveats

• Payload limit: 100 KB. Larger payloads are rejected with 413.
• Credentials are never returned. The API does not expose the stored signing secret.
• Signature headers are not logged. x-webhook-secret, Stripe-Signature, Authorization, and similar are scrubbed on the server before the history log is written.
• Retention: 7 days of history per connection, including auth failures for self-diagnosis.

Related

• Integrations - per-provider setup and the support matrix
• Custom HMAC - configure any HMAC-SHA256 provider
• Webhook Received - the trigger that starts your flow
• Webhook History - every request and its outcome