Workflow webhooks
Choose plain inbound or sender-verified webhooks and handle delivery types safely.
Plain inbound webhooks
webhook({ key, name? }) declares an unverified endpoint: any request to it starts a run. Treat the input as untrusted and validate the fields your workflow needs before doing external work. A plain endpoint does not prove who sent the request; use a sender-specific helper below when you need supported signature verification.
The trigger key identifies the endpoint. Keep it stable across edits: changing it issues a different URL. name is display text, not an identity or an authentication setting.
Signed webhooks
A sender that signs its deliveries gets its own helper, imported from @wix/whenever-workflow-sdk/webhooks. The platform verifies each delivery with that sender's connection in Setup before your code runs.
| Helper | Receives |
|---|---|
stripeWebhook({ key, name? }) | Stripe events, verified with the endpoint's signing secret. Deliveries older than five minutes are refused. |
githubWebhook({ key, name? }) | Repository, organization or GitHub App events. GitHub names the event in ctx.trigger.eventType, not in the body. |
shopifyWebhook({ key, name? }) | Store events from a webhook made in the store admin or subscribed by an app. |
slackAppEventsWebhook({ key, name?, event? }) | A Slack app's Event Subscriptions. event narrows the endpoint to one Slack event, such as app_mention. |
metaAppWhatsAppWebhook({ key, name? }) | WhatsApp Business messages from a Meta app. Status receipts and other objects never start a run. |
telegramBotWebhook({ key, name? }) | A Telegram bot's updates, verified with the secret token given to setWebhook. |
discordAppInteractionsWebhook({ key, name? }) | Slash commands, buttons and modal submissions. The platform defers each one; reply within fifteen minutes. |
discordAppEventsWebhook({ key, name? }) | App authorizations, deauthorizations and entitlements, named in ctx.trigger.eventType. |
standardWebhook({ key, name? }) | Any sender following the Standard Webhooks specification. |
Unless the helper narrows it, a signed endpoint receives every event kind the sender is configured to send. Branch on ctx.trigger.eventType before any provider write and return an ignored result for the kinds you do not handle — publish refuses a provider write that an unrelated event could reach.