# Secure an inbound hook

> A SkedX Flow inbound hook’s address works like a password. When creating the hook, “How the other app proves it’s really them” can require a second proof: a secret word in the X-Flow-Secret header, a secret in the address (?secret=), a username and password (HTTP Basic, stored as user:pass), or a signature — X-Flow-Signature: sha256=<hex HMAC-SHA256 of the raw body, keyed with the shared secret>. A call without the right proof gets 401 and does nothing. Each hook also takes at most 300 calls a minute, and “Never more than … a day” caps calls that run each day (reset at midnight UTC); past it Flow answers 429 and sends nothing. Hooks can’t be edited: if a secret or address leaks, create a new hook, move your tool to it and delete the old one — its address stops working at once.

Product: SkedX Flow · Topic: APIs & Developers · Draft — steps not yet re-verified in the live product

Anyone who learns a hook’s address can call it. That’s fine for a test; before real customers, make the calling app send a second proof, and cap how many calls a day can run. Both are choices on the hook form — no code in Flow.

## Step 1: Choose how the other app proves it’s them

On the hook form, pick one under **How the other app proves it’s really them**, then type the secret:

- **The secret address alone** — nothing extra. Fine for a test.
- **A secret word in a header** — the app sends `X-Flow-Secret: <secret>`. The easiest upgrade; Zapier and n8n can both add a header.
- **A secret word in the address** — the app adds `?secret=<secret>`, for tools that can’t send headers.
- **A username and password** — HTTP Basic sign-in; type it as `user:pass`.
- **A signature we check** — the strongest: the app signs every body with the secret.

## Step 2: Sign each call, for the strongest check

With **A signature we check**, the app computes an HMAC-SHA256 of the exact body it sends, keyed with the secret, and sends it as `X-Flow-Signature: sha256=<hex>` (the `sha256=` part is optional). A wrong or missing signature gets `401` and nothing happens; the same body signed properly runs.

```bash
BODY='{"phone": "919876543210"}'
SIG=$(printf '%s' "$BODY" | openssl dgst -sha256 -hmac "$HOOK_SECRET" -hex | cut -d' ' -f2)

curl -s -X POST "$HOOK_URL" \
  -H "Content-Type: application/json" \
  -H "X-Flow-Signature: sha256=$SIG" \
  -d "$BODY"
```

## Step 3: Know what a refusal looks like

Each proof has its own `401` message, so the calling app’s owner can see what to fix: “wrong or missing X-Flow-Secret header”, “wrong or missing ?secret= value”, a missing, malformed or wrong HTTP Basic sign-in, or “wrong or missing X-Flow-Signature (HMAC-SHA256 of the raw body)”. Refused calls send nothing and show in the hook’s **Recent calls**.

## Step 4: Set a daily cap

**Never more than … a day** limits how many calls the hook runs each day; the count resets at midnight UTC (5:30 am in India) and only calls that actually ran count. Past it, Flow answers `429` — daily cap reached — and sends nothing, so a leaked address costs at most the cap. Every hook also takes at most 300 calls a minute.

## Step 5: If an address or secret leaks

Hooks can’t be edited, so replace it: create a new hook with a new secret, move your tool to its address, then open the old hook in the list and click **Delete**. Its address stops working at once.

## Common questions

### Which proof should I pick for Zapier or n8n?

**A secret word in a header**: both can add an `X-Flow-Secret` header to their request. Use a signature when your own developers call the hook.

### Is the secret shown again after I create the hook?

No, just as the address isn’t. Keep both in your tool’s settings; if you lose them, replace the hook (step 5).

### How big a daily cap should I set?

A little above your busiest real day — for 200 students a day, 250. When the cap is hit, Flow answers `429`, and your tool’s error alerts tell you.

## Useful links
- Inbound Hooks in Flow — Settings → Developers → Inbound Hooks: https://flow.skode.ai/settings/?tab=inbound_hooks

Videos and screenshots © 2026 SkedX, with sample data only. Share and link to them freely; copying the SkedX product or its design is not allowed. Terms: https://skode.ai/terms/

## Related guides
- Send WhatsApp templates without code, using an inbound hook: https://skode.ai/help/flow/developers/inbound-hooks-send-without-code/
- Check that a webhook really came from Flow: https://skode.ai/help/flow/developers/check-a-webhook-came-from-flow/
- Flow API errors, and how to fix each one: https://skode.ai/help/flow/developers/flow-api-errors/
- Connect Flow to Zapier: https://skode.ai/help/flow/developers/connect-flow-to-zapier/

Source: https://skode.ai/help/flow/developers/secure-an-inbound-hook/