Inbound webhook setup guide

Building blocks: send and receive requests, read the web and other everyday tools.

To put Inbound webhook to work after connecting it, see Intake: webhooks, watched endpoints and rules.

Ways to connect

Company admins connect apps, on the Integrations page in Everdeck: open Inbound webhook, choose one of the ways below, follow its steps and fill in its fields. Everdeck checks what you enter before it saves anything, and asks you to confirm it’s you (your second factor) before you type any secret. How connecting works.

Inbound webhook can be connected 3 ways.

HMAC-SHA256 signature (recommended)

No sign-in.

1. Save the connection to get its webhook URL and signing secret, or paste the secret the sending app generated.
2. In the sending app, add the URL as a webhook endpoint (method POST) with the same secret.
3. The app must sign each request with an HMAC-SHA256 of the raw body, keyed with the secret, in the header named above, as GitHub (X-Hub-Signature-256, hex) and Shopify (X-Shopify-Hmac-Sha256, base64) do.
4. Send a test event, then add an intake rule that turns requests into tasks for the right agent.

Field	What to enter
Signing secret (optional)	A secret: Everdeck saves it encrypted and never shows it again. Leave blank to have one generated, or paste the secret the sending app gave you.
Signature header (optional)	Text. Starts as X-Signature-256. The header carrying the signature, for example X-Hub-Signature-256 (GitHub) or X-Shopify-Hmac-Sha256 (Shopify).
Signature encoding (optional)	Choice: Hex (a sha256= prefix is accepted), Base64. Starts as hex.
Delivery id header (optional, used to ignore retries)	Text. For example X-GitHub-Delivery. A header that stays the same when the app retries, for example X-GitHub-Delivery (GitHub) or X-Shopify-Webhook-Id (Shopify).

Disconnecting turns its address off and deletes what Everdeck saved for it.

Standard Webhooks signature (webhook-id, webhook-timestamp, webhook-signature)

No sign-in.

1. Save the connection to get its URL and a whsec_ signing secret, or paste the secret the sending app shows. Apps that send through Svix use the same scheme (svix-* headers).
2. Add the URL as an endpoint in the sending app.
3. Send a test event, then add an intake rule that turns requests into tasks for the right agent.

Field	What to enter
Signing secret (whsec_...) (optional)	A secret: Everdeck saves it encrypted and never shows it again. Leave blank to have one generated, or paste the whsec_ secret the sending app shows.

Disconnecting turns its address off and deletes what Everdeck saved for it.

Secret URL only (for apps that can't sign requests)

No sign-in.

1. Save the connection to get its URL. The URL is the only secret: anyone who has it can send requests, so give it only to the sending app (for example a Zapier, Make or form webhook step).
2. Add the URL in the sending app and send a test request.
3. Add an intake rule. If the URL leaks, rotate it on this page; the old one stops working.

Disconnecting turns its address off and deletes what Everdeck saved for it.

What can start work

These events from the app that sends the requests can become tasks for your agents through Intake. How Intake works.

A request with a valid signature (or, for secret-URL connections, to the right URL) arrived.

On the Intake page, open Webhooks and sources and select New webhook. Name it, choose how requests prove where they're from, and copy the URL (and signing secret) Everdeck shows once into the app that sends the requests. Then, on the Rules tab, select New rule to say which requests become tasks and who gets them.

Testing, problems and disconnecting

Everdeck checks the connection when you save it. On the connection’s page in Integrations, Test checks it again at any time.

To stop agents using Inbound webhook, open the connection and select Disconnect. Agents stop using it at once and its saved credentials are deleted. What else happens depends on how it was connected: each way above says.