Direct download only. This feature isn't in the Setapp edition. Compare editions
At a glance
- Fires when
- A request arrives on your relay channel
- Emits
- Body, headers, method, path, timestamp, channel id
- Needs
- An owned license or a Watchflows Cloud subscription
Set it up
Select the node and press Create Public URL. Watchflows provisions a channel and the How to Use section shows its full address, https://hooks.watchflows.app/<channel-id>. Paste that into whatever should call you.
The relay is a pipe. It accepts the request, holds it in a queue, and hands it to your Mac over a secure connection. Signature checking and payload parsing happen locally — the relay never sees your signing secret and never sends a reply from your flow back to the caller. Senders always get 202 Accepted.
Configure
| Field | Default | What it does |
|---|---|---|
| Verify HMAC Signature | Off | Check each request's signature on this Mac before the flow fires. |
| Signature Scheme | GitHub | GitHub (x-hub-signature-256), Stripe (stripe-signature), or Generic (x-signature: sha256=…). |
| Signing Secret | — | The shared secret from the sending service. Stays on this Mac and is scrubbed from exports. |
| Custom Arguments | — | Extra key-value pairs merged into the payload. |
The channel id is not a field you type. It is written by Create Public URL, and the inspector shows only its first 8 characters everywhere except How to Use.
Output
Every key is available downstream as {{key}}.
| Key | Type | Value |
|---|---|---|
body | Object | The JSON body — reach inside it with body.field |
headers | Object | Request headers, names lowercased |
method | String | The HTTP method used |
path | String | The request path |
timestamp | String | When the relay received the request, ISO 8601 |
channelId | String | The channel id's first 8 characters |
Example: a GitHub push reaches your Mac
Public Webhook receives the delivery and verifies it with the GitHub scheme. Template reads {{body.repository.name}} and {{body.ref}}. Notification shows the result.
Paste this into the Flow Builder to get the same flow:
Give me a public webhook that verifies GitHub signatures and notifies me which repo and branch was pushed.
Good to know
The URL is the credential. There is no separate token — anyone holding the address can post to your channel. Exports scrub it automatically, but if it leaks, press Regenerate: the old address stops working at once. Revoke kills the channel without replacing it.
Turn on Verify HMAC Signature for anything that supports it. A request with a missing or wrong signature is dropped with a trigger error and the flow does not fire. Verification runs here, over the exact bytes the sender transmitted.
Nothing is lost while the Mac is asleep. Deliveries queue for about 24 hours and arrive in order on reconnect. The trigger remembers what it already ran, so a redelivered duplicate is discarded rather than fired twice — even across a restart. Deliveries that failed verification are not confirmed, so fixing a wrong secret recovers them on the next reconnect.
Fair-use caps per channel: 60 requests a minute (senders over it get 429); about 100 KB per request, and less for binary, which is base64-expanded on the way through (413 over it); an offline queue of 200 requests or 5 MB; 24 hours of retention. Each license can hold 10 channels.
Needs an owned license or Watchflows Cloud. Creating, regenerating, and revoking a channel requires either an owned license or an active Cloud subscription, activated here. Public webhooks are included with both at no extra cost. Settings ▸ Webhooks also has an Enable public relay switch — with it off, these nodes receive nothing.