That’s fine for a test; before real customers, make the calling app send a second proof, and cap how many calls a day can run. Both are choices on the hook form — no code in Flow.
In review: written from the product, not yet walked through live.
1Choose how the other app proves it’s them
On the hook form, pick one under How the other app proves it’s really them (1), then type the secret (2):
- The secret address alone — nothing extra. Fine for a test.
- A secret word in a header — the app sends
X-Flow-Secret: <secret>. The easiest upgrade; Zapier and n8n can both add a header. - A secret word in the address — the app adds
?secret=<secret>, for tools that can’t send headers. - A username and password — HTTP Basic sign-in; type it as
user:pass. - A signature we check — the strongest: the app signs every body with the secret.
2Sign each call, for the strongest check
With A signature we check, the app computes an HMAC-SHA256 of the exact body it sends, keyed with the secret, and sends it as
X-Flow-Signature: sha256=<hex> (the sha256= part is optional). A wrong or missing signature (1) gets 401 (2) and nothing happens; the same body signed properly (3) runs (4).BODY='{"phone": "919876543210"}'
SIG=$(printf '%s' "$BODY" | openssl dgst -sha256 -hmac "$HOOK_SECRET" -hex | cut -d' ' -f2)
curl -s -X POST "$HOOK_URL" \
-H "Content-Type: application/json" \
-H "X-Flow-Signature: sha256=$SIG" \
-d "$BODY"
3Know what a refusal looks like
Each proof has its own
401 message, so the calling app’s owner can see what to fix: “wrong or missing X-Flow-Secret header”, “wrong or missing ?secret= value”, a missing, malformed or wrong HTTP Basic sign-in, or “wrong or missing X-Flow-Signature (HMAC-SHA256 of the raw body)”. Refused calls send nothing and show in the hook’s Recent calls.4Set a daily cap
Never more than … a day limits how many calls the hook runs each day; the count resets at midnight UTC (5:30 am in India) and only calls that actually ran count. Past it, Flow answers
429 — daily cap reached (1) — and sends nothing, so a leaked address costs at most the cap. Every hook also takes at most 300 calls a minute.
5If an address or secret leaks
Hooks can’t be edited, so replace it: create a new hook with a new secret, move your tool to its address, then open the old hook in the list and click Delete. Its address stops working at once.
© 2026 SkedX · Sample data only · Share and link freely · Copying the product or its design is not allowed · Terms
Common questions
Which proof should I pick for Zapier or n8n?
A secret word in a header: both can add an
X-Flow-Secret header to their request. Use a signature when your own developers call the hook.Is the secret shown again after I create the hook?
No, just as the address isn’t. Keep both in your tool’s settings; if you lose them, replace the hook (step 5).
How big a daily cap should I set?
A little above your busiest real day — for 200 students a day, 250. When the cap is hit, Flow answers
429, and your tool’s error alerts tell you.Next in APIs & DevelopersGet notified with outbound webhooks →
Useful links
- Inbound Hooks in Flow — Settings → Developers → Inbound Hooks
Previous: Send WhatsApp templates without code, using an inbound hook · All APIs & Developers guides
Did this guide help?
Still stuck?Chat with support →
