At a glance
- Fires when
- A request matches the node's path and method
- Emits
- Body, headers, method, path, timestamp
- Reachable from
- This Mac by default; your LAN with an auth token
Set it up
Give the node a path and a method. One small HTTP server serves every webhook node; its port, its binding, and a master switch live in Settings ▸ Webhooks. The default is port 9274 on localhost.
Configure
| Field | Default | What it does |
|---|---|---|
| Path | /webhook | The path to listen on. A leading slash is added if you leave it off. |
| Require Auth Token | On | Demand Authorization: Bearer <secret> on every request. |
| Secret | — | The token callers must send. Required before this node can be exposed on the LAN, and at least 16 characters. |
| Method | POST | POST, GET, PUT, or DELETE. |
| Custom Arguments | — | Extra key-value pairs merged into the payload. |
Output
Every key is available downstream as {{key}}.
| Key | Type | Value |
|---|---|---|
body | Object | The JSON body — reach inside it with body.field |
headers | Object | Request headers — headers.content-type and friends |
method | String | The HTTP method used |
path | String | The request path |
timestamp | String | When the request arrived, ISO 8601 |
Example: a build script pings your Mac
Webhook listens on /build-done. Template turns {{body.branch}} into a sentence, Notification shows it.
Paste this into the Flow Builder to get the same flow:
Listen for a POST on /build-done and notify me which branch finished.
Good to know
Nothing on the open internet can reach this. The listener binds to loopback, or at most your local network. For GitHub, Stripe, or anything hosted elsewhere, use Public Webhook.
LAN exposure needs a real secret. A node binds to the local network only when Require Auth Token is on and its Secret is at least 16 characters. Anything less is refused.
One wrong token blocks every node on the route. If any node on the same path and method requires auth, a bad Authorization header gets a 401 and none of them fire — a no-auth sibling must never confirm which route is unprotected.