# Webhooks, right in your flows

Your OneText flows already handle plenty without any help from you. They welcome new subscribers, recover abandoned carts, and check in after a purchase. Every so often, though, a flow needs to tell *your* systems something. Maybe it should update an order, ping your warehouse, kick off fulfillment, or log an event in your own database.

The new **Webhook step** makes that a built-in part of any flow. Drop it in wherever it belongs, then point it at a URL you control. When a customer reaches that step, OneText sends a POST request to your endpoint, with the flow's data in the body. There's no middleware to run and no polling to set up, and you don't have to host any glue code.

![A Webhook step that fires after a customer replies YES to an order-confirmation text, then posts to the merchant's endpoint](https://cdn.hashnode.com/res/hashnode/image/upload/v1783203966913/4764c4c7-7277-42bd-ba48-77418b438702.png)

## Add it where it fits

It sits in the flow editor right next to your message, product, and purchase steps. Usually it belongs later in a flow, once something has actually happened. In the example above, the flow sends an order confirmation, waits for the customer to reply YES, and only then fires the webhook to notify the store's systems. Add a **Webhook** step, paste in your **Webhook URL**, and that's it. OneText will POST a JSON body to that URL every time the flow reaches the step. The step even comes with its own **Success** and **Error** branches, so you can decide what happens next based on whether your endpoint accepted the call.

## Know exactly what we'll send

There's no guessing about the shape of the request. Expand **Example payload** and you'll see the exact JSON body OneText posts to your URL, ready to copy. It includes the event type, a timestamp, and the parameters your flow passed along, so you can correlate the call on your side.

![The example payload, showing the exact JSON body OneText POSTs, with a copy button and delivery notes](https://cdn.hashnode.com/res/hashnode/image/upload/v1783203967061/fec13119-c058-44ca-8541-6320d73ed000.png)

The delivery rules are spelled out in plain language too. We wait up to 30 seconds per attempt and retry on failures. Each request carries an idempotency key, so you can safely dedupe if the same webhook arrives more than once.

## Trust every request

Because your endpoint now acts on these calls, you'll want to be sure each one really came from OneText and not someone spoofing your URL. Expand **Verify signatures** and everything you need is there: the `x-onetext-signature` format, a copy-pasteable verification snippet in **Node.js or Python**, and your account's signing secret (kept masked until you reveal it).

![Signature verification, with a copy-ready Node.js/Python snippet and your masked signing secret](https://cdn.hashnode.com/res/hashnode/image/upload/v1783203967168/4b907dad-90cd-4364-b7a4-ebcd7ff3fb1c.png)

Check the signature against your secret and you can trust that every webhook is genuine and untampered before you act on it.

## Why it matters

A flow that can call your own systems can do almost anything. The automations your customers see on their phone can now drive the systems that run your business behind the scenes, in real time. Delivery is reliable, and every request can be verified before you act on it. Think of it as the bridge between OneText and everything else you run.

**Open any flow, add a Webhook step, and point it at your endpoint.** Already building rich automations, like the [RCS messages that now live in the same flow editor](https://onetext.hashnode.dev/2026-07-04-rcs-flow-editor)? This slots right in beside them.