Skip to content
← All setup guides

Apex Academy · 6 steps

Webhook setup guide

Connect Apex to Zapier, Make, n8n, or your own server, prove the connection with a test event, and only then turn on the automation.

Open my setup
  1. 01

    Create a receiving webhook first

    Zapier: create a Zap with Webhooks by Zapier → Catch Hook. Make: add Webhooks → Custom webhook and click Run once. n8n: add a Webhook node, set POST, and start listening on its Test URL.

    Copy the HTTPS URL shown by that service. Keep the receiving screen open because it must be listening when you send the first test.

    If you are stuck: Apex accepts public HTTPS URLs only. Localhost, private IP addresses, HTTP URLs, and redirects to private networks are blocked for security.

    Done when this step is saved and verified in your own account.

  2. 02

    Add the endpoint and choose what should trigger it

    Open Webhooks in Apex and paste the receiving URL. Give it a plain description such as 'Send new leads to Zapier'.

    Select lead.created for captured contact details, conversation.started for the first turn of each chat, and message.received for every visitor message. Leave checked only the events your workflow actually needs.

    Click Add endpoint. Apex shows a secret once. Copy it only if you use a custom server; Zapier, Make, and n8n users can leave it stored safely without mapping it.

    Done when this step is saved and verified in your own account.

  3. 03

    Send a real signed test event

    In Active endpoints, choose the event you want to test and click Send test. Apex sends the same JSON structure, signature header, SSRF checks, and timeout used in production.

    Do not continue until Apex shows a green HTTP success and your receiving service displays the sample payload.

    If you are stuck: A 404 usually means the wrong URL. A 401/403 means the receiver rejected the request. A timeout means the receiver did not answer within five seconds. Fix the receiver, then send the test again.

    Done when this step is saved and verified in your own account.

  4. 04

    Map the fields to the next action

    Map data.name, data.email, data.phone, data.message, and data.conversation_id where they exist. The event field tells your workflow which payload type arrived.

    Start with one harmless action, such as creating a spreadsheet row or sending yourself an internal notification. Confirm the values before adding customer-facing actions.

    {
  "event": "lead.created",
  "tenant_id": "...",
  "data": {
    "name": "Apex test lead",
    "email": "test@example.com",
    "test": true
  },
  "ts": 1783699200000
}

    Done when this step is saved and verified in your own account.

  5. 05

    Activate and verify with one real conversation

    Turn on the Zap, Make scenario, or n8n workflow. Open your chatbot in a private window, start a conversation, send a message, and leave a test email address.

    Check that each subscribed event arrived once and that the intended action ran. Test data from the Send test button always includes data.test=true; a real customer event does not.

    Done when this step is saved and verified in your own account.

  6. 06

    Verify signatures on custom servers

    Custom code should read the raw request body and compare the X-Apex-Signature header with an HMAC-SHA-256 digest made with your endpoint secret.

    Reject invalid signatures before parsing or acting on the payload. Use a timing-safe comparison in production.

    const rawBody = await request.text();
const signature = request.headers.get('x-apex-signature') ?? '';
const expected = signWebhook(rawBody, process.env.APEX_WEBHOOK_SECRET);
if (!timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
  return new Response('Invalid signature', { status: 401 });
}

    Done when this step is saved and verified in your own account.

Now do it in your account

The dashboard fills in your real code and settings automatically.

Open my setup