Webhooks

Zapify both receives and sends webhooks.

Receiving

Add the A webhook is received trigger. Zapify generates a URL with a long random key in it — that URL is the credential, so treat it as one.

Anything that can POST JSON can drive an automation this way: Stripe, Paddle, GitHub, Zapier, a script of your own.

Listen mode

Rather than guessing what a service sends, use Listen. Zapify captures the next delivery and builds the token list from the payload it actually received, so you are picking from real field names instead of reading somebody's API documentation.

Sources

A source is one URL that feeds many automations, each selecting itself on the payload — usually the event type. One Stripe endpoint can drive a dozen automations without a dozen URLs to configure at Stripe's end.

The free build supports up to three sources this way; Pro removes the limit.

Signatures

Signature verification, rate limiting and a per-source key come with incoming webhooks on the free plan. Eight authentication schemes are covered, including verified signatures for the common providers. Stripe and Paddle sign a timestamp joined to the body rather than the body alone, and Zapify handles them as such — deliveries outside a five-minute window are refused even when the signature verifies, so a captured delivery cannot be replayed indefinitely.

Pro adds reusable auth profiles, secret rotation for zero-downtime key changes, signing your own outgoing requests, and retry policies.

Deduplication

Providers retry. Zapify records a deduplication key per delivery with a unique index, so the same delivery arriving twice runs the automation once even if both copies arrive at the same instant.

Sending

The Send a webhook action posts anywhere. Method, headers, and a body built from fields or written raw. Authentication can be a reusable connection or set per action.

What it will not do

Requests to loopback, link-local and private network ranges are refused unless you explicitly allow them with ZAPIFY_ALLOW_INTERNAL_REQUESTS. The hostname is resolved and re-checked after redirects, so a public URL that redirects to 127.0.0.1 does not get through either.

That is deliberate: without it, any admin who can build an automation can make your server fetch anything on your internal network.

Replay — Pro

Every delivery is kept. Dry run asks why a delivery did not match a particular automation, and bulk replay re-runs a filtered set — useful after fixing an automation that was wrong while deliveries were arriving.