3.5Webhooks & custom integrations
The essentials in 30 seconds
- The webhook triggers in real time: a URL provided by your scenario; as soon as a service sends data to it, the scenario starts instantly.
- The HTTP module calls anything: GET/POST request (URL, method, headers, body) to any API, response often in JSON to map.
- Secrets stay secret: API key via the tool's encrypted connections, never in plain text — and webhook tested before building the rest.
Running case — Lina links her business tool with no connector
Lina, digitalisation officer in Oran, uses a business tool with no ready-made connector: impossible to plug in the standard way. She creates a webhook-triggered scenario, pastes the provided URL into the notification settings of the tool, then sends a test call whose structure she observes. The other way round, she adds an HTTP module that calls the service API (with the key stored in the encrypted connection), retrieves the response and maps its fields to the database. No-code becomes limitless.
Last episode of the Lina thread — from choosing the tool to custom integrations: advanced automation end to end.
1. The webhook, universal trigger
When an app has no ready-made connector, you go through webhooks and API calls. A webhook is a URL that your scenario provides: as soon as another service sends data to this URL (a payment validation, a form, a custom event), the scenario triggers instantly with this data. It is the universal, real-time trigger.
The principle to grasp: “an address that, when spoken to, wakes up my automation”. No need to code: paste the URL into the “webhook / notifications” settings of the other service, send a test call, and observe the received structure for mapping.
2. The HTTP module and secret discipline
The other way round, the HTTP module lets you call any API: sending a request (GET, POST…) to a service, with its parameters and authentication, and retrieving the response (often in JSON) for the rest of the scenario. Understanding the basics (URL, method, headers, body, JSON) opens access to thousands of services even with no official connector.
Non-negotiable discipline: the API key is a password — tool encrypted connections, minimal rights, regeneration if it may have leaked, never in plain text in the scenario nor on a shared screenshot. Webhooks (in) + HTTP calls (out) make no-code truly limitless: it is also the bridge to AI and the custom integrations of level 4.
🔎 Concrete example — Receiving via webhook, then calling an API
Lina connects the unconnectable, both ways.
Trigger: Webhook (URL provided by the scenario)
→ the service sends data (JSON) there on each event
HTTP module: call an API (GET/POST, headers, encrypted key)
→ retrieve the JSON response, map to the next action.Reading: real-time in on one side, custom out on the other.
Lesson: test webhook reception before building the rest.
Section vocabulary
- Webhook
- URL provided by your scenario; receiving data on it triggers it instantly (universal, real-time trigger).
Simple example: The URL Lina pastes into her business tool notifications.
What it is not: periodic checking with delay (polling).
Reflex: send a test call and observe the received structure.
- API
- Interface letting two pieces of software communicate: you send a request, you receive a response (often in JSON).
Simple example: The business tool API Lina queries via HTTP.
What it is not: a ready-made connector already built in.
Reflex: read the API documentation before the first call.
- HTTP request
- Call to an API (GET/POST… method, URL, headers, body) to read or send data.
Simple example: Lina's parameterised call to the external service.
What it is not: a simple form trigger.
Reflex: check method, URL and headers before sending.
- JSON
- Standard text format for exchanging structured data (key/value pairs, lists) returned by most APIs.
Simple example: The response received by Lina, mapped field by field.
What it is not: a document formatted for printing.
Reflex: map each JSON key to the right target field.
- Authentication (API key/token)
- Mechanism proving your identity to an API (key, token), to pass in the request and to keep secret.
Simple example: Lina's key stored in the tool's encrypted connection.
What it is not: a key pasted in plain text in the shared scenario.
Reflex: encrypted secret + minimal rights + regeneration if in doubt.
In practice — Triggering via webhook and calling an API
- Create a webhook-triggered scenario: copy the provided URL and configure a service to send it data.
- Send a first test call and observe the received data (JSON structure) in the scenario.
- Add an HTTP module to call an external API (method, URL, headers, key via the encrypted connection).
- Retrieve the JSON response and map its fields to the next action; test end to end.
Ready-to-say script — plugging in a tool with no connector (30 s)
“This tool has no connector, so I am going custom. One: I create a webhook trigger, I paste its URL into the tool notifications and I send a test call. Two: I add an HTTP module to call its API, key in the encrypted connection, and I map the JSON response to our database. I test end to end before activating.”
To say before plugging in; never paste a real key into a shared demo.
Copy-paste template — webhook payload (fictitious example)
// PAYLOAD RECEIVED ON THE WEBHOOK — fictitious data and URL (teaching example)
// Fictitious URL: https://exemple-fictif.test/crochet/abc123 (do not use as is)
{
"evenement": "demande_recue",
"contact": { "nom": "Exemple Fictif", "objet": "DEVIS" },
"articles": [ { "nom": "Article A", "montant": 1200 } ]
}
// MAPPING → database: nom → Contact, objet → Titre, articles → iterator (3.4)SMB / freelancer
One webhook is enough to link a form or a simple tool in real time, without changing subscription.
SME in Oran
Lina links her business tool to internal tracking: webhook in, HTTP out, encrypted secrets.
Digital team
Document each custom integration (URL, method, JSON mapping) to maintain it without depending on one person.
Beginner
Practise first with the webhook alone: receive a test call and observe the data before any HTTP call.
✓ Best practices
- Use a webhook for universal real-time triggering.
- Call missing APIs via the HTTP module (JSON).
- Store API keys encrypted (built-in connections).
✗ Common pitfalls
- Putting an API key in plain text in the scenario.
- Forgetting authentication/headers in an HTTP request.
- Not testing webhook reception before building the rest.
Key takeaways
- A webhook is a URL that triggers the scenario instantly when a service sends it data.
- The HTTP module calls any API (GET/POST, headers, body) and retrieves the response.
- Data often travels in JSON (key/value, lists) to map to the rest.
- Webhooks + HTTP calls give access to services with no official connector — no-code with no limit.
48h challenge — apply tomorrow
Create 1 webhook scenario, send a test call and observe the received JSON structure.
- I know what a real-time webhook is.
- I know how to call an API via HTTP + JSON.
- My keys are in an encrypted connection, never in plain text.
Frequently asked questions
Is a webhook complicated? Do I need to code?
No, no need to code. Concretely, the tool gives you a URL; you just enter this URL in the other service (in its “webhook” / “notifications” settings) so it sends data there on each event. Your scenario receives it and triggers. The only thing to understand is the principle: “an address that, when spoken to, wakes up my automation”. Data arrives in JSON, which the tool displays readably for mapping. It is often simpler and more instant than a classic connector, and it works with almost any service able to send a webhook.
Where do I put my API key to call a service safely?
Never in plain text in the visible body of the scenario nor in a shared field. The right reflexes: use the tool's built-in connections/authentication (which store the secret encrypted), or environment variables/secret vaults when available (especially with n8n, level 4). An API key is a password: anyone who gets it can act on your behalf and consume your quotas. Keep it secret, regenerate it if it leaked, and limit its rights to the minimum needed. Secret security is detailed in section 4.5.
What does a webhook allow?