# HTTP Webhook Trigger

> Start an automation when an external service POSTs to your unique Taskade webhook URL. Pass JSON and route it through any actions.

- Source: https://www.taskade.com/learn/automation/webhook-trigger
- Section: Automation
- Updated: 2026-11-03
- Index of all pages: https://www.taskade.com/learn/llms.txt

## Overview

The HTTP Webhook trigger gives any Taskade automation a unique inbound URL. Any system that can POST JSON can start the automation. Pair it with branching, looping, and AI actions to build any pipeline you need.

> **TL;DR:** Add the **Webhook Received** trigger to any automation, copy the unique URL, and POST JSON from any external system to fire your workflow. Available on Pro, Business, Max, and Enterprise. Pair with [Branch](https://www.taskade.com/learn/automation/branch-action), [Loop](https://www.taskade.com/learn/automation/loop-action), [Utility Actions](https://www.taskade.com/learn/automation/utility-actions), and [Structured Output](https://www.taskade.com/learn/automation/structured-output) to handle real-world payloads end to end.

## How the trigger fits the loop

A webhook is the canonical Execution input: an external system tells Taskade something happened, and your automation runs the rest of the loop.

```mermaid
sequenceDiagram
    participant Ext as External system<br/>(any HTTP client)
    participant TK as Taskade Webhook URL
    participant FLOW as Automation
    participant MEM as Projects (Memory)
    participant AGENT as Agents (Intelligence)
    Ext->>TK: POST /webhook { JSON }
    TK->>FLOW: parse body, headers, queryParams
    FLOW->>MEM: create or update a Project
    FLOW->>AGENT: ask an agent to reason on the payload
    AGENT-->>FLOW: structured result
    FLOW-->>Ext: 202 Accepted
```

## Webhook trigger vs. action

These two sound the same but flow in opposite directions. Pick the one that matches the data direction you need.

| Type | Direction | What it does |
| --- | --- | --- |
| **HTTP Webhook trigger** (this article) | Inbound | Receives a POST from an external system and starts an automation |
| **[Webhook action](https://www.taskade.com/learn/automation/webhooks)** | Outbound | Sends a POST from a running automation to an external system |

If your goal is "when something happens in Stripe, run my Taskade automation," you want the trigger. If your goal is "when my Taskade automation finishes, notify Slack through a custom URL," you want the action.

## Set up the trigger

Create the trigger first, then wire your external system to the URL it gives you.

1. Open the automation you want to start from a webhook.
2. Click **Add Trigger**.
3. Pick **Webhook Received** from the HTTP trigger list.
4. Copy the unique **Webhook URL** shown in the trigger panel.
5. Click **Save**.

Keep that URL handy. You will paste it into the external service that needs to fire the automation.

## Reference fields from the payload

The trigger parses incoming JSON automatically when the request includes `Content-Type: application/json`. It also accepts a plain HTML form post (`application/x-www-form-urlencoded`) and a multipart form, and turns the form fields into the same `body` object. A field that repeats, such as a group of checkboxes, arrives as a list. The full payload is exposed to every downstream action through five variables you can reference with the `@` picker or `{{ }}` syntax.

| Variable | What it holds | Example |
| --- | --- | --- |
| `body` | Parsed JSON object | `{{trigger.body.customer_email}}` |
| `bodyText` | Raw payload as a string | `{{trigger.bodyText}}` |
| `headers` | Request headers, without credential headers such as `authorization` | `{{trigger.headers["x-status-secret"]}}` |
| `method` | HTTP verb (always `POST` here) | `{{trigger.method}}` |
| `queryParams` | URL query string keys | `{{trigger.queryParams.source}}` |

To pull a single nested value out of `body`, pair the trigger with [Get Multiple Values (JSONPath)](https://www.taskade.com/learn/automation/utility-actions) and a JSONPath query like `$.user.email`. To work with the raw text (for example, to verify a signature header), reach for `bodyText`.

## Test the trigger

Send a real request from your terminal to make sure that the trigger fires and your fields parse correctly.

```bash
curl -X POST "YOUR_WEBHOOK_URL" \
  -H "Content-Type: application/json" \
  -d '{
    "customer_email": "test@example.com",
    "order_id": "ORD-1042",
    "amount": 49.00
  }'
```

A successful request returns **HTTP 202 Accepted**. The automation runs in the background and you can watch progress in the **Runs** tab.

| Response | What it means | What to do |
| --- | --- | --- |
| 202 Accepted | Payload accepted, automation queued | Open Runs to watch the steps complete |
| 400 Bad Request | JSON malformed or field types do not match | Validate the payload at jsonlint.com |
| 404 Not Found | Wrong URL, or automation is paused | Re-copy the URL and toggle the automation on |

## Reliability and retries

Taskade stores every accepted delivery before processing it, so a brief downstream hiccup never loses an event.

- Every accepted POST is stored before any action runs. A request that fails the **Verify requests** check gets `401 Unauthorized`, and Taskade does not store it.
- Actions that error are retried automatically with backoff. An agent step is the exception. It runs once, with up to 15 minutes to finish.
- You can run a failed delivery again from the **Runs** tab with the **Retry** button. The button shows only on a run where a step failed. A run that finished every step, or a run whose trigger failed, has no **Retry** button.
- Long-running actions do not block the next webhook from being accepted.

This is the same reliable retry behavior used by every action in the automation.

## Plan availability

The HTTP Webhook trigger is available on Pro and above because it accepts unbounded inbound traffic from any external service.

| Plan | HTTP Webhook trigger |
| --- | --- |
| Free, Starter | Use built-in triggers like Forms, Schedule, and task events |
| Pro, Business, Max, Enterprise | Full HTTP Webhook trigger access |

See the [pricing page](https://www.taskade.com/pricing) for the latest plan matrix.

## Authenticate inbound requests

The URL acts as a shared secret. With **Verify requests** set to **None**, anyone who gets the URL can start the automation. Pick a check under **Verify requests** on the trigger, so that Taskade rejects a request that does not pass. A rejected request gets `401 Unauthorized`, and the automation does not run.

| Verify requests | What the sender must send | When to use it |
| --- | --- | --- |
| **None** | Nothing. The trigger panel warns that the webhook is public. | Only for a test, or for data that is not private |
| **Bearer token** | `Authorization: Bearer <token>`, with the **Authorization Token** that the trigger shows | Most tools and your own code. Works everywhere |
| **Stripe signature** | The `Stripe-Signature` header that Stripe adds. Paste the signing secret of your Stripe webhook endpoint into **Signing secret**. | Events from a Stripe webhook endpoint |
| **HMAC-SHA256 signature** | A hex HMAC-SHA256 digest of `<timestamp>.<body>`, made with your **Signing secret**, in `X-Taskade-Signature-V2`, plus the time in `X-Taskade-Timestamp`. You can rename both headers. | A sender that signs each request |

With **Stripe signature** or **HMAC-SHA256 signature**, Taskade also rejects a request that is older than 5 minutes. Until you add the signing secret, the trigger rejects every request.

### Use the Bearer token

1. Set **Verify requests** to **Bearer token**.
2. Turn on the automation. Taskade then creates the **Authorization Token**.
3. Click **Show** or **Copy** next to **Authorization Token**.
4. Paste the token into the sending tool as a Bearer token.

```bash
curl -X POST "YOUR_WEBHOOK_URL" \
  -H "Authorization: Bearer YOUR_AUTHORIZATION_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "order_id": "ORD-1042" }'
```

### Check a header of your own

If the sender can only add a header with a name of its own, send a shared secret in that header, for example `x-status-secret`. Then compare `{{trigger.headers["x-status-secret"]}}` with the secret in a [Branch](https://www.taskade.com/learn/automation/branch-action) or [Filter Data](https://www.taskade.com/learn/automation/filter-data) step. This check runs inside the automation, so Taskade accepts the request and starts a run. Put the check first, before any step that reads, changes, or sends data.

Taskade removes credential headers from the trigger data before any step runs: `authorization`, `proxy-authorization`, `cookie`, `set-cookie`, `x-api-key`, and `x-auth-token`. A step cannot read them, so do not use one of these names for your own secret.

## Security tips

Treat the webhook URL like a password. Anyone holding it can fire your automation.

- Keep the URL out of public repos, screenshots, and shared docs.
- Set **Verify requests** to **Bearer token**, or to a signature check when the sender signs its requests.
- If you think that the URL or the token leaked, turn the automation off until you fix the leak.
- Prefer a signature check when the source supports it, for example **Stripe signature** for Stripe events.

## Frequently Asked Questions

**What does the HTTP Webhook trigger do?**

It gives any Taskade automation a unique inbound URL that an outside system can POST to. When any service sends JSON to that URL, your automation runs. This is the easiest way to start an automation from another tool, like a payment platform or a custom backend.

**Where do I find my webhook URL?**

Open the automation, click **Add Trigger**, and pick **Webhook Received** from the HTTP trigger list. Taskade shows your unique **Webhook URL** right in the trigger panel. Copy it, click **Save**, and paste it into the external service you want to fire the automation.

**What data does the automation receive from a webhook?**

When the request includes a JSON content type, Taskade parses it automatically. A plain HTML form post also works, and its fields arrive in the same parsed body. Every later step then gets five pieces of the request: the parsed body, the raw body text, the headers, the HTTP method, and the URL query parameters. You can reference any of them with the `@` picker or `{{ }}` syntax. This lets you route names, emails, order IDs, and anything else straight into your actions.

**How do I keep my webhook URL safe?**

Treat the URL like a password, since anyone holding it can fire your automation. Keep it out of public repos, screenshots, and shared docs. For extra protection, set **Verify requests** to **Bearer token** or to a signature check. If you think that the URL leaked, turn the automation off.

**How do I test the webhook trigger?**

Send a real POST request from your terminal with a small JSON body, like the curl example above. A successful request returns **HTTP 202 Accepted**, which means your payload was accepted and the automation is queued. Open the **Runs** tab to watch the steps run and make sure that your fields parsed correctly.

**What happens if a delivery fails or my automation has a hiccup?**

Taskade stores every accepted POST before any action runs, so a brief downstream issue never loses an event. A request that fails the **Verify requests** check gets `401 Unauthorized` and is not stored. Actions that error are retried automatically with backoff, except an agent step, which runs once. When a step fails, click **Retry** on that run in the **Runs** tab to run it again. A run that finished every step, or a run whose trigger failed, has no **Retry** button. Long-running actions also do not block the next webhook from being accepted.

**Which plan includes the HTTP Webhook trigger?**

The HTTP Webhook trigger is available on the **Pro, Business, Max, and Enterprise** plans. On Free and Starter you can still use built-in triggers like Forms, Schedule, and task events. On Free and Starter, Taskade refuses each call to the webhook address. If you turn on an automation with this trigger in the web app, Taskade opens the upgrade window instead. The same occurs if you change the trigger of an automation that is on to this one. An automation that is already on stays on, but Taskade still refuses each call to its address until you upgrade. See the [pricing page](https://www.taskade.com/pricing) for the latest plan matrix.

### Related guides

- [Webhooks (Action)](https://www.taskade.com/learn/automation/webhooks). Outbound counterpart that sends events from Taskade.
- [Branch Action](https://www.taskade.com/learn/automation/branch-action). Route incoming payloads to different paths.
- [Loop Action](https://www.taskade.com/learn/automation/loop-action). Iterate over arrays inside a webhook payload.
- [Structured Output](https://www.taskade.com/learn/automation/structured-output). Turn raw payloads into typed variables.
- [HTTP Request Action](https://www.taskade.com/learn/automation/http-request). Call external APIs from inside the automation.