Incoming webhooks let an external service send an HTTP POST request to a dedicated endpoint and start a workflow in AI Agent Workflows. They are useful when a CRM, payment service, or custom application needs to send an event into WordPress.
How incoming webhooks work
Each webhook is linked to a workflow and has its own public URL. When a request reaches that URL, the plugin checks the webhook’s configured IP allow-list and signing requirements, then passes the request body to the linked workflow. Only an active workflow can run from an incoming webhook.
Screenshot to add: [Webhooks management screen]
Secure the endpoint before using it
The endpoint is public and does not require a WordPress login. Treat its URL as sensitive and configure the protections that fit the calling service:
- Signing secret: When a secret is configured, the caller must send a valid HMAC signature for the exact raw request body. The site-wide setting can require signing for every webhook.
- IP allow-list: Restrict requests to known IP addresses or supported IPv4 CIDR ranges. An empty list allows any source IP.
- Request volume: The endpoint limits each webhook and source IP to 60 requests per 60 seconds. This is a basic rate limit, not a guarantee against abuse.
- Workflow status: Draft or paused workflows cannot be started by the endpoint. Activate the intended workflow first.
Configure an endpoint
Use the existing Configure an Incoming Webhook Endpoint guide to create the endpoint, select a workflow, set a signing secret or IP allow-list, send a test POST request, and inspect the resulting run.