The Incoming Webhook Receiver is a Krom Automation Pro feature that gives every workflow its own unique, secret URL. Any external service that can send an HTTP POST request — Stripe, GitHub, Shopify, Zapier, a custom application, or any platform that supports outgoing webhooks — can POST data to that URL and fire the workflow automatically.

It’s the bridge between Krom Automation and any service that isn’t covered by a native Pro integration.

How it works #

When you add the Incoming Webhook trigger to a workflow, Krom Automation generates a 256-bit cryptographically random token and creates a unique webhook URL for that workflow:

https://yoursite.com/wp-json/krom-automation/v1/webhooks/{64-character-token}

You copy that URL and paste it into the external service’s webhook configuration. From that point on, every time the external service sends a POST request to the URL, Krom Automation receives the payload, validates it, and fires the workflow with the incoming data available as merge tags.

Setting up the Incoming Webhook trigger #

1. Go to Krom Automation > Workflows and click Add New Workflow.
2. Give the workflow a descriptive name — for example, Stripe Payment Event or GitHub Deploy Notification.
3. Click Add Trigger and select Incoming Webhook from the Utility category.
4. The trigger node appears on the canvas. Click it to open the configuration panel.
5. Your unique webhook URL is displayed in the panel. Copy it.

Screenshot: Incoming Webhook trigger node on the canvas with the webhook URL visible in the configuration panel.

6. Paste the webhook URL into your external service’s webhook settings. The exact location varies by service — see the service-specific examples below.
7. Add your actions to the canvas, build out the workflow, and activate it.

Screenshot: Workflow canvas with the Incoming Webhook trigger connected to action nodes.

Once the workflow is Active, Krom Automation starts listening at that URL. The first time your external service sends a POST, the workflow fires.

Using webhook payload data as merge tags #

Every key in the incoming JSON payload becomes a merge tag you can use in the workflow’s actions.

If the external service sends this payload:

{
  "event": "payment.completed",
  "customer_email": "jane@example.com",
  "amount": 99.00,
  "currency": "USD",
  "order_id": "ord_abc123"
}

You can use {{customer_email}}, {{amount}}, {{currency}}, and {{order_id}} in any action field in the workflow. Krom Automation makes every top-level key available as a merge tag automatically.

For nested JSON objects, use dot notation:

{
  "customer": {
    "name": "Jane Smith",
    "email": "jane@example.com"
  }
}

Access these as {{customer.name}} and {{customer.email}}.

Configuring webhooks in external services #

Stripe

1. In the Stripe Dashboard, go to Developers > Webhooks.
2. Click Add endpoint.
3. Paste your Krom Automation webhook URL into the endpoint URL field.
4. Select the Stripe events you want to send (for example, payment_intent.succeeded, customer.subscription.deleted).
5. Click Add endpoint.

For added security, enable HMAC signature verification in Krom Automation (see the Security section below). Stripe signs every webhook with your endpoint’s signing secret. Krom Automation can verify that signature to confirm requests are genuinely from Stripe.

Screenshot: Stripe webhook configuration screen with the Krom Automation URL pasted into the endpoint field.

GitHub

1. Go to your GitHub repository settings and click Webhooks.
2. Click Add webhook.
3. Paste your Krom Automation webhook URL into the Payload URL field.
4. Set Content type to application/json.
5. Choose which events to send (for example, push events, release events, or pull request events).
6. Click Add webhook.

Shopify

1. In your Shopify admin, go to Settings > Notifications.
2. Scroll to the Webhooks section and click Create webhook.
3. Choose the event (for example, orders/create or customers/create).
4. Set the format to JSON and paste your Krom Automation webhook URL.
5. Click Save webhook.

Any other service

If a service supports outgoing webhooks with a configurable URL and JSON payloads, paste your Krom Automation webhook URL into that service’s webhook configuration. The process is the same regardless of the platform.

Security #

The webhook receiver applies nine security layers to every incoming request. You don’t need to configure most of these — they’re active by default.

Layer	What it does
Token format validation	The 64-character token is enforced by the route pattern. Malformed URLs are rejected before any processing.
IP-based rate limiting	Blocks an IP after 20 failed requests within 5 minutes, preventing brute-force attempts.
Payload size cap	Rejects payloads larger than 1 MB to prevent memory exhaustion attacks.
Constant-time token comparison	Uses hash_equals() instead of direct string comparison to prevent timing attacks.
Cache re-verification	Validates the token on every request even when cached, preventing stale-cache bypass.
HMAC-SHA256 signature verification	Optional. Verifies that the request was signed by the expected sender. Compatible with Stripe and GitHub webhook signatures.
Recursive payload sanitisation	Cleans the payload to a maximum depth of 10 levels and 1 MB to prevent deeply nested injection attacks.
Workflow active-status check	Confirms the workflow is Active before firing. Inactive workflows silently ignore incoming requests.
Sensitive value protection	The webhook token and signing secret never appear in error messages, logs, or API responses.

Enabling HMAC signature verification

HMAC signature verification is optional but recommended when your external service supports it (Stripe, GitHub, and others do).

1. Click the Incoming Webhook trigger node on the canvas.
2. In the configuration panel, find the Signing Secret field.
3. Enter the signing secret provided by your external service. For Stripe, this is the endpoint’s signing secret from the Stripe Dashboard. For GitHub, this is the secret you set when creating the webhook.
4. Save the workflow.

Once enabled, Krom Automation verifies the X-Hub-Signature-256 (GitHub) or Stripe-Signature header on every incoming request. Requests without a valid signature are rejected.

Regenerating the webhook token #

If your webhook URL is compromised or you want to rotate the token for security reasons:

1. Click the Incoming Webhook trigger node on the canvas.
2. In the configuration panel, click Regenerate Token.
3. A new 64-character token is generated and the webhook URL updates immediately.
4. Copy the new URL and update it in your external service’s webhook settings.

Screenshot: Incoming Webhook configuration panel showing the Regenerate Token button.

Any requests sent to the old URL after regeneration will be rejected. Update your external service’s webhook URL promptly after regenerating.

Testing the webhook #

Before relying on an external service to send real events, test the webhook to confirm Krom Automation is receiving requests correctly.

Option 1: Use a tool like Postman or curl. Send a test POST request to your webhook URL with a sample JSON payload. Check Krom Automation > Logs to see if the execution was recorded and what payload data was received.

curl -X POST https://yoursite.com/wp-json/krom-automation/v1/webhooks/YOUR_TOKEN \
  -H "Content-Type: application/json" \
  -d '{"event": "test", "email": "test@example.com"}'

Option 2: Use the external service’s test webhook feature. Most services (Stripe, GitHub, Zapier) have a “Send test webhook” or “Redeliver” button in their webhook settings. Use it to send a sample payload and verify Krom Automation receives it.

Option 3: Use the connectivity test endpoint. Send a GET request to your webhook URL. Krom Automation returns a 200 response to confirm the URL is reachable, without revealing whether the token is valid or triggering a workflow execution.

Frequently asked questions #

Can I use the same webhook URL for multiple external services?

Technically yes, but it’s not recommended. The payload structure from different services varies significantly. Create a separate workflow with its own webhook URL for each external service to keep your automations clean and maintainable.

Does the workflow need to be Active before webhooks will fire it?

Yes. Krom Automation checks the workflow’s Active status before processing an incoming request. If the workflow is Paused, incoming webhooks are silently ignored.

What happens if Krom Automation receives a webhook while a previous execution is still running?

Each execution runs as an independent background job via Action Scheduler. New webhook requests queue new executions without waiting for previous ones to finish.

Can I use the Incoming Webhook trigger with the free plugin?

No. The Incoming Webhook trigger and receiver are Krom Automation Pro-only features.