Skip to main content

​
Webhooks Overview

Webhooks let Cortado notify another system the moment a workflow step runs — a new lead, a quote that was just sent, a payment that cleared. You register a URL under Settings > Integrations > Webhooks, then add a Send webhook step to any workflow. Webhooks are part of Workflows. If you don’t see the Webhooks section, workflows aren’t enabled for your organization yet.

​
Register an Endpoint

1

Open Webhooks

Go to Settings > Integrations > Webhooks and click Add endpoint.
2

Name it and paste a URL

Use a name that says where it goes (Zapier — new leads, n8n payment alert). The URL must be a public https address — local or private hosts are rejected.
3

Optional headers

Add any extra headers your receiver needs, such as an API key. Cortado reserves its own X-Cortado-* headers, so you can’t set those yourself.
4

Copy the signing secret

Cortado shows the secret once, prefixed with whsec_. Store it in your automation tool. You won’t see it again unless you rotate it.
Treat the signing secret like a password. Anyone who has it can forge deliveries that look like they came from Cortado. Rotate it if it may have leaked.

​
What Gets Sent

Each delivery is a signed JSON POST. The body includes:
  • event — what happened (for example a lead stage change), manual if you ran the workflow yourself, or webhook.test for a test ping
  • data type and id — the record the workflow is acting on
  • timestamps — when the trigger happened and when this delivery was sent
  • trigger payload — the details from the workflow trigger
Cortado also sends headers your receiver can use to verify and dedupe:
  • X-Cortado-Signature — timestamped signature of the body
  • X-Cortado-Event — the event type
  • X-Cortado-Delivery — a stable id, the same on every retry of that step
  • X-Cortado-Timestamp — when this attempt was signed
Have your receiver check X-Cortado-Signature before trusting the body, and ignore a delivery you’ve already processed with the same X-Cortado-Delivery id.

​
Test, Disable, and Rotate

From the endpoints table you can:
  • Send test — Cortado posts a webhook.test event immediately so you can confirm the URL and signature check work
  • Enable / disable — a disabled endpoint stays in the list but workflows that target it fail until you turn it back on
  • Rotate secret — issues a new whsec_ secret (shown once) and invalidates the old one
  • Delete — remove an endpoint you no longer use. Cortado blocks delete while a workflow still points at it

​
Add a Send Webhook Step

Once at least one endpoint exists:
  1. Open Workflows and edit a workflow (or start from a template).
  2. Add a Send webhook step from the palette.
  3. Choose the endpoint. The URL and secret stay on the endpoint — the step only picks which one to call.
Failed deliveries are retried. If the other system rejects the request (most 4xx responses), that step fails and the run stops. See the Workflows guide for triggers, other steps, and how to watch runs.

​
Best Practices

  1. Use one endpoint per tool — if you rotate or disable Zapier, n8n keeps working
  2. Copy the secret immediately — it’s shown once on create and on rotate
  3. Send a test before you turn the workflow on — confirm the URL and signature check first
  4. Keep the URL on https — Cortado won’t deliver to http or private hosts
  5. Dedupe on the delivery id — retries reuse the same X-Cortado-Delivery so your tool shouldn’t create a second task
  6. Disable instead of deleting while you debug — workflows that still reference a deleted endpoint can’t be saved

Workflows

Build the automations that fire your webhooks.

API Keys

Pull leads and contacts from your own tools.

Settings

Where Integrations and Webhooks live.

Staff

Who can manage settings and automations.