HTTP Webhook Trigger

Overview

The HTTP Webhook trigger gives any Taskade automation a unique inbound URL. Any system that can POST JSON can start the automation. Pair it with branching, looping, and AI actions to build any pipeline you need.

TL;DR: Add the Webhook Received trigger to any automation, copy the unique URL, and POST JSON from any external system to fire your workflow. Available on Pro, Business, Max, and Enterprise. Pair with Branch, Loop, Utility Actions, and Structured Output to handle real-world payloads end to end.

How the trigger fits the loop

A webhook is the canonical Execution input: an external system tells Taskade something happened, and your automation runs the rest of the loop.

Webhook trigger vs. action

These two sound the same but flow in opposite directions. Pick the one that matches the data direction you need.

If your goal is "when something happens in Stripe, run my Taskade automation," you want the trigger. If your goal is "when my Taskade automation finishes, notify Slack through a custom URL," you want the action.

Set up the trigger

Create the trigger first, then wire your external system to the URL it gives you.

1. Open the automation you want to start from a webhook.
2. Click Add Trigger.
3. Pick Webhook Received from the HTTP trigger list.
4. Copy the unique Webhook URL shown in the trigger panel.
5. Click Save.

Keep that URL handy. You will paste it into the external service that needs to fire the automation.

Reference fields from the payload

The trigger parses incoming JSON automatically when the request includes Content-Type: application/json. It also accepts a plain HTML form post (application/x-www-form-urlencoded) and a multipart form, and turns the form fields into the same body object. A field that repeats, such as a group of checkboxes, arrives as a list. The full payload is exposed to every downstream action through five variables you can reference with the @ picker or {{ }} syntax.

To pull a single nested value out of body, pair the trigger with Get Multiple Values (JSONPath) and a JSONPath query like $.user.email. To work with the raw text (for example, to verify a signature header), reach for bodyText.

Test the trigger

Send a real request from your terminal to make sure that the trigger fires and your fields parse correctly.

curl -X POST "YOUR_WEBHOOK_URL" \
  -H "Content-Type: application/json" \
  -d '{
    "customer_email": "test@example.com",
    "order_id": "ORD-1042",
    "amount": 49.00
  }'

A successful request returns HTTP 202 Accepted. The automation runs in the background and you can watch progress in the Runs tab.

Reliability and retries

Taskade stores every accepted delivery before processing it, so a brief downstream hiccup never loses an event.

• Every accepted POST is stored before any action runs. A request that fails the Verify requests check gets 401 Unauthorized, and Taskade does not store it.
• Actions that error are retried automatically with backoff. An agent step is the exception. It runs once, with up to 15 minutes to finish.
• You can run a failed delivery again from the Runs tab with the Retry button. The button shows only on a run where a step failed. A run that finished every step, or a run whose trigger failed, has no Retry button.
• Long-running actions do not block the next webhook from being accepted.

This is the same reliable retry behavior used by every action in the automation.

Plan availability

The HTTP Webhook trigger is available on Pro and above because it accepts unbounded inbound traffic from any external service.

See the pricing page for the latest plan matrix.

Authenticate inbound requests

The URL acts as a shared secret. With Verify requests set to None, anyone who gets the URL can start the automation. Pick a check under Verify requests on the trigger, so that Taskade rejects a request that does not pass. A rejected request gets 401 Unauthorized, and the automation does not run.

With Stripe signature or HMAC-SHA256 signature, Taskade also rejects a request that is older than 5 minutes. Until you add the signing secret, the trigger rejects every request.

Use the Bearer token

1. Set Verify requests to Bearer token.
2. Turn on the automation. Taskade then creates the Authorization Token.
3. Click Show or Copy next to Authorization Token.
4. Paste the token into the sending tool as a Bearer token.

curl -X POST "YOUR_WEBHOOK_URL" \
  -H "Authorization: Bearer YOUR_AUTHORIZATION_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "order_id": "ORD-1042" }'

Check a header of your own

If the sender can only add a header with a name of its own, send a shared secret in that header, for example x-status-secret. Then compare {{trigger.headers["x-status-secret"]}} with the secret in a Branch or Filter Data step. This check runs inside the automation, so Taskade accepts the request and starts a run. Put the check first, before any step that reads, changes, or sends data.

Taskade removes credential headers from the trigger data before any step runs: authorization, proxy-authorization, cookie, set-cookie, x-api-key, and x-auth-token. A step cannot read them, so do not use one of these names for your own secret.

Security tips

Treat the webhook URL like a password. Anyone holding it can fire your automation.

• Keep the URL out of public repos, screenshots, and shared docs.
• Set Verify requests to Bearer token, or to a signature check when the sender signs its requests.
• If you think that the URL or the token leaked, turn the automation off until you fix the leak.
• Prefer a signature check when the source supports it, for example Stripe signature for Stripe events.

Frequently Asked Questions

Related guides

• Webhooks (Action). Outbound counterpart that sends events from Taskade.
• Branch Action. Route incoming payloads to different paths.
• Loop Action. Iterate over arrays inside a webhook payload.
• Structured Output. Turn raw payloads into typed variables.
• HTTP Request Action. Call external APIs from inside the automation.