Webhooks & triggers

Switching a trigger on (Activation)

Choosing Scheduled or Webhook in the trigger node's settings doesn't turn it on by itself. The trigger's settings have an Activation panel at the top:

• Save the workflow first.
• Press Activate schedule or Activate webhook. It uses the settings you entered below it.
• If you change the schedule later, save and press the button again (it now says Update schedule / Update webhook) to apply the change.
• Schedules and webhooks always run the latest saved version of the workflow. There's no separate publish step.
• If you change the trigger back to Manual, anything still switched on is listed under "Still switched on" with Disable and Delete buttons, so it doesn't keep starting runs.

Webhook triggers

• Double-click the trigger node and set the type to Webhook.
• Choose the Auth Mode: Shared Secret (a token header, the default), Signature (HMAC), Secret + Signature, or None (not recommended). Optionally pick a vault credential to use as the secret, set an IP allowlist, or require specific headers.
• Save the workflow, then press Activate webhook.
• Copy the URL and, if no vault credential was chosen, the secret that's generated. The secret is shown only once — store it somewhere safe.
• Send POST requests with a JSON body to the URL, with the secret in the x-fluxo-secret header (or the header name you set). Triggers set up before October 2026 may show x-webhook-token: the name saved on the trigger is the one checked.

The URL is fixed for each workflow: /api/triggers/webhook/<workflow id>. A successful request returns {"accepted": true, "invocationId": "…"}; the run is queued and starts within about a minute. The request body (up to 256 KB) is passed to the workflow as the trigger's output.

curl -X POST https://flow.fluxosuite.com/api/triggers/webhook/WORKFLOW_ID \
  -H "Content-Type: application/json" \
  -H "x-fluxo-secret: YOUR_WEBHOOK_SECRET" \
  -d '{"event": "user.signed_up", "user_id": 42}'

With Signature mode, send an HMAC-SHA256 of the raw request body, computed with the secret, in the signature header (x-fluxo-signature by default) as sha256=<hex digest>.

Scheduled triggers

• Double-click the trigger node and set the type to Scheduled.
• Pick a Schedule Type: One-time, Daily, Weekly, Monthly or Cron Expression (standard 5 fields: minute hour day-of-month month day-of-week). The cron field shows the next run time as you type.
• Pick the timezone the schedule runs in.
• Check Allowed Days and the Run Window. The run window is off by default (runs go around the clock); if you turn it on, scheduled runs outside it or on unticked days are skipped.
• Optionally set start and end dates.
• Save the workflow, then press Activate schedule.

A scheduler checks for due schedules every minute, so scheduled runs start within about a minute of their time. Each workflow has one active schedule; pressing Update schedule replaces it.

A schedule faster than your plan allows is refused when you activate it. If you downgrade to another paid plan, existing schedules are slowed to the new plan's pace rather than stopped. On the Free plan schedules don't run at all, because Free can't run workflows live.

Manual runs and starting runs from your own systems

With a Manual trigger, the workflow runs when someone presses Run on the canvas. To start a workflow from your own systems, either call the REST API (POST /api/v1/workflows/{id}/runs with an API key — see API reference) or give it a Webhook trigger, activate it, and POST to its URL.

App event triggers

Set the trigger type to App event, then pick the app, the connected account, the event (for example New row in Google Sheets, New contact in HubSpot, New message in a Slack channel) and its settings. Save the workflow and press Activate app trigger in the Activation panel. Each new item starts one run; its fields reach the next step as {{input.payload.<field>}} and any later step as {{trigger.<field>}}. Marketplace agents that start from an app event work the same way: connect the app, pick the account on the trigger, then activate it.

• Checked on a schedule: the app is checked at your plan's schedule interval (the same floor as schedules). The first check only remembers what's already there, so old items don't start runs.
• Repeats are ignored: the same row, contact or message never starts two runs.
• Instant events (ClickUp, Pipedrive, Slack, Stripe, Telegram and Calendly): the app sends each event to Fluxo Flow as it happens, signed and checked. For most of them Fluxo registers the webhook with the app itself when you activate the trigger and removes it when you switch the trigger off; instant Slack triggers use Fluxo Flow's Slack app, so there's nothing to paste.
• Webhook events you set up by hand (HTTP / Custom API → Incoming webhook, Greenhouse web hooks): you get a URL and a signing secret, shown once. For the Custom API, requests must carry X-Fluxo-Signature = "sha256=" + HMAC-SHA256(secret, raw body). Repeated event ids are ignored.
• If the account's access is revoked, the trigger stops, the connection is marked Needs reconnect and admins get a notification.
• Changing the trigger type away from App event leaves the app trigger listed under Still switched on until you disable or delete it.

Rotating a webhook secret

To change a generated secret, delete the webhook under the Activation panel and press Activate webhook again — a new secret is generated and shown once. If you use a vault credential as the secret, update that credential instead (or pick a different one and press Update webhook). Update your callers with the new secret.

Common errors & fixes

Webhook returns 403

The secret header or signature is missing or wrong, the caller's IP isn't in the allowlist, a required header is missing, or the webhook is switched off. The response message says which. Check the header name and Auth Mode in the trigger's settings.

Webhook returns 404 "No webhook is configured at this URL"

The webhook hasn't been activated for this workflow, or the workflow ID in the URL is wrong. Save the workflow and press Activate webhook.

Scheduled workflow never runs

• It wasn't activated — press Activate schedule in the trigger's Activation panel.
• The workspace is on the Free plan, which can't run workflows live. Choose a paid plan in Billing.
• The Run Window is turned on and the time falls outside it, or the day isn't ticked in Allowed Days.
• The cron expression is invalid — the field shows an error instead of the next run time.
• Check the workflow's Runs tab: a run that started but failed shows there, and you'll also get a notification in the bell.

"You've reached your plan's limit" when activating a schedule

The schedule repeats faster than your plan allows. Slow it down or upgrade in Settings → Billing.