Public Webhook

Trigger dot.radiowaves.up.forward

trigger.public_webhook

Fires when an HTTP request arrives on your public hooks.watchflows.app channel — reachable from anywhere on the internet, with no port forwarding, no tunnel, and no server of your own. GitHub, Stripe, Zapier, a cron job on a VPS: anything that can POST a URL can now reach a flow on your Mac.

The relay is a dumb pipe: it accepts the request, holds it briefly in an encrypted queue, and hands it to your Mac over a secure connection. Signature verification, payload parsing, and everything that matters happens locally. If your Mac is asleep or offline, deliveries wait in the queue (up to ~24 hours) and arrive in order when it reconnects. Read exactly what our servers can and cannot see in What Transits Our Servers.

How It Fits Together

A GitHub webhook travels through the relay to the Public Webhook trigger on your Mac, where the signature is verified before the flow runs.

The grey boxes live on the internet. Everything from the green node onward runs on your Mac.

Your Channel URL

Select the node and click Create Public URL in the inspector. Watchflows provisions a channel and shows its full address in the How to Use section:

https://hooks.watchflows.app/<your-64-character-channel-id>

The URL is the key. There is no separate username or token — anyone who has the URL can post to your channel. Treat it like a password:

The full URL appears in exactly one place: the node's How to Use section. Everywhere else — payloads, run history, the canvas — shows only the first 8 characters.
Exporting or sharing a flow scrubs the channel ID automatically — a shared flow never carries your URL.
If the URL leaks anyway — pasted in a chat, committed to a repo — click Regenerate… in the inspector. The old URL stops working immediately; update the services that post to it. Revoke… kills the channel without replacing it.

Requires Watchflows Cloud. Creating, regenerating, and revoking public channels needs an active Watchflows Cloud subscription (any tier) with its license activated in the app. Each license can hold up to 10 channels. Deactivating your license revokes all of its channels server-side.

Configuration

Field	Type	Default	Description
Channel ID	`Text`	—	Filled in by Create Public URL — you never type this by hand
Verify HMAC Signature	`Boolean`	false	Check each request's signature on your Mac before the flow fires
Signature Scheme	`Dropdown`	GitHub	GitHub (`x-hub-signature-256`), Stripe (`stripe-signature`), or Generic (`x-signature: sha256=…`)
Signing Secret	`Secret`	—	The shared secret from the sending service — stays on your Mac, scrubbed from exports, never sent to the relay
Custom Arguments	`Key-Value`	—	Additional key-value pairs included in the output payload

Verifying Signatures (HMAC)

Because anyone holding the URL can post to it, turn on Verify HMAC Signature for any service that supports webhook signing. Verification runs on your Mac, over the exact bytes the sender transmitted — the relay never sees your secret. A request with a missing or wrong signature is dropped with a trigger error and the flow does not fire.

GitHub

1 In your repo: Settings → Webhooks → Add webhook.
2 Paste your channel URL as the Payload URL and set Content type to application/json.
3 Type a strong random string into GitHub's Secret field, and paste the same string into this node's Signing Secret with the scheme set to GitHub. GitHub signs every delivery with it as x-hub-signature-256.

Stripe

1 In the Stripe Dashboard: Developers → Webhooks → Add endpoint, and paste your channel URL as the endpoint.
2 Open the endpoint Stripe created and reveal its Signing secret — it starts with whsec_.
3 Paste it into this node's Signing Secret with the scheme set to Stripe. Watchflows verifies the stripe-signature header on every delivery.

Anything else

The Generic scheme accepts the common convention: an x-signature header carrying sha256=<HMAC-SHA256 of the raw body>. If you control the sender (a script, a serverless function), sign with a shared secret and you get the same forgery protection GitHub and Stripe provide.

When Your Mac Is Offline

Nothing is lost while you sleep. Every accepted request is queued for up to ~24 hours. When your Mac reconnects, queued deliveries arrive in the order they were received, then the flow runs once per delivery.
Flows never double-fire. Delivery is at-least-once under the hood (the relay redelivers anything your Mac didn't confirm), but the trigger keeps a persistent record of what already fired — a redelivered duplicate is confirmed and discarded, even across an app crash or restart.
Senders always get 202 Accepted. The relay never proxies a response from your flow back to the caller — it can't, and by design it won't. Webhooks in, nothing out.
Fixed a wrong signing secret? Deliveries that failed verification aren't confirmed — they stay queued and re-verify on the next reconnect, so requests that arrived while the secret was wrong are recovered (within the ~24-hour window).

Fair-Use Limits

The relay is included with your license. These caps keep it healthy for everyone — they're far above what webhook automation normally needs.

Limit	Value	When exceeded
Requests per channel	60 / minute	Sender gets `429`; well-behaved services retry
Request size	~100 KB text / ~70 KB binary	Sender gets `413`; never accepted-then-dropped
Offline queue per channel	200 requests or 5 MB	Sender gets `429` until your Mac drains the queue
Queue retention	~24 hours	Older undelivered requests expire and are never delivered
Channels per license	10	Revoke an unused channel to free a slot

Output Variables

Variable	Type	Description
`body`	Object	JSON body — use body.field for nested access
`headers`	Object	Headers, names lowercased — use headers.content-type etc.
`method`	String	HTTP method used
`path`	String	Request path
`timestamp`	String	ISO 8601 timestamp the relay received the request
`channelId`	String	First 8 characters of the channel ID — enough to tell channels apart, never the full secret URL

Try It

After clicking Create Public URL, copy the curl example from the node's How to Use section and run it from any machine, anywhere:

curl -X POST \
  -H "Content-Type: application/json" \
  -d '{"message": "hello"}' \
  https://hooks.watchflows.app/<your-channel-id>

Downstream nodes read the payload the same way as the local Webhook trigger: {{body.message}}, {{headers.content-type}}, and so on.

Troubleshooting

Symptom	What it means / what to do
Sender gets `404`	The channel was revoked or regenerated (or the URL has a typo). Copy the current URL from How to Use and update the sending service.
Sender gets `429`	Over 60 requests/minute on the channel, or the offline queue is full (200 requests / 5 MB). Slow the sender down, or bring your Mac online so the queue drains.
Sender gets `413`	The request exceeds the size cap (~100 KB text, ~70 KB binary). Send a reference (an ID or URL) instead of the blob, and fetch the heavy part with an API Request node.
Flow doesn't fire; trigger shows a signature error	HMAC verification failed — the secret in the node doesn't match the sender's, or the wrong scheme is selected. Fix it and the still-queued deliveries re-verify on the next reconnect.
“Watchflows Cloud subscription required”	Public channels need an active Watchflows Cloud subscription (any tier). Subscribe from Settings → Cloud, or activate the license that came with your plan.
Node armed but nothing arrives	Check Settings → Webhooks → Enable public relay. When it's off, public-webhook nodes receive nothing (the inspector shows a warning on the node too).
Shared a flow and worried about the URL	Exports scrub the channel ID, so the flow file is safe. If you pasted the URL itself somewhere, click Regenerate… — the old URL dies instantly.

Public Webhook vs. Webhook

The local Webhook trigger runs an HTTP server on your Mac — perfect for scripts and apps on the same machine or LAN, zero infrastructure, nothing leaves your network. Public Webhook is for senders that live on the internet and could never reach your Mac directly. Same payload shape, same downstream wiring — choose by where the sender lives.