A trigger link for each automation
An incoming automation gets its own trigger link, a URL you paste into the service that sends the webhook. While the automation is a draft, events that arrive are stored so you can inspect them but they do not run anything. Once it is turned on, every event runs the script.
The script receives the parsed JSON body, the raw body, the request headers and a stable event id it can use to avoid handling the same delivery twice.
Signatures, verified for you
Anyone who knows a URL can send to it, so real webhook handlers check a signature. ClickRuntime has built-in verification for Stripe, GitHub, Shopify, Typeform and Standard Webhooks (used by Svix, Clerk, Resend and others), plus generic HMAC-SHA256.
Save the sender's signing secret in the ClickRuntime dashboard, choose the provider on the automation page, and turn on "Require signature". Deliveries that fail verification are rejected and never reach your script.
Two patterns
The assistant picks one and says which in the summary.
- Each event performs the action: a payment arrives, a Slack message goes out.
- Events are remembered, and the action runs on a schedule: collect form submissions all day, send one digest at 6pm.
Testing before it goes live
On the automation page you can send a test event with any JSON body and see the run it produces, or look at the most recent real events with secret headers masked. In your assistant, ask "show me the last event" and the assistant can adjust the script to match the real payload.