Input

Webhook

GET/POST · expose payload

The Webhook node lets another system start a workflow by sending it a message over the web. It is how dojobase plugs into the tools you already run: when something happens over there, a job starts over here.

How it works

You get a URL. When another application sends data to that URL (a new record, an event, a form submission from a system you use), it becomes a job, with that data ready for the next step.

It is protected so only senders you trust can trigger it. This is the general-purpose connector for wiring dojobase into the rest of your stack.

Common use cases

Real situations where this node earns its place in a flow.

Trigger from another app

Have your CRM, form builder, or app POST to the webhook so an event over there starts a workflow here.

Bridge no-code tools

Point Zapier, Make, or any automation platform at the webhook URL to route data into a dojobase workflow.

Receive verified events

Accept authenticated payloads (HMAC, key, or IP match) from a trusted service and expose the body to the rest of the flow.

Webhook in a workflow

A simple example of where this node sits in a flow.

What you set up

Copy the webhook URL the node provides.
Give it to the other system as the place to send its events.
Choose how senders prove they are allowed (a shared key is the default).

Common questions

Is it open to anyone?

No. The node requires the sender to prove it is allowed, a shared key by default, so random traffic cannot start jobs.

Settings you configure on this node, stored under data.config in the workflow JSON. Leave a field unset to use its default.

Field	Type	Default	What it controls
`methods`	enum: POST \| GET \| GET,POST	`POST`	Which HTTP methods this endpoint accepts; anything else is rejected.
`authMode`	enum: key \| hmac-signature \| ip-allowlist \| header-match	`key`	How senders prove they are allowed to trigger the job; there is no anonymous mode.
`sharedSecret`req	string	—	The webhook key, HMAC secret, or expected header value; required for every mode except ip-allowlist.
`matchHeader`	string	—	Name of the header that must equal the secret; used only when authMode is header-match.
`allowedIps`	string	—	Comma or space separated client IPs permitted to call the endpoint; used only when authMode is ip-allowlist.

methods
Which HTTP methods this endpoint accepts; anything else is rejected.
Type: enum: POST | GET | GET,POSTDefault: POST
authMode
How senders prove they are allowed to trigger the job; there is no anonymous mode.
Type: enum: key | hmac-signature | ip-allowlist | header-matchDefault: key
sharedSecretreq
The webhook key, HMAC secret, or expected header value; required for every mode except ip-allowlist.
Type: string
matchHeader
Name of the header that must equal the secret; used only when authMode is header-match.
Type: string
allowedIps
Comma or space separated client IPs permitted to call the endpoint; used only when authMode is ip-allowlist.
Type: string

How this node appears inside a workflow's nodes[] array (the shape you see in the Developer export / import). A full workflow is { nodes: [...], edges: [...] }.

{
  "id": "webhook-in",
  "type": "card",
  "position": {
    "x": 160,
    "y": 120
  },
  "data": {
    "type": "webhook-in",
    "kind": "input",
    "title": "Webhook",
    "subtitle": "GET/POST · expose payload",
    "config": {
      "methods": "POST",
      "authMode": "key",
      "sharedSecret": "",
      "matchHeader": "",
      "allowedIps": ""
    }
  }
}