Make.com Setup Guide
Follow these 6 steps to activate your DangWire automation on Make.com.
Create a Make.com Account
Sign up for a free Make.com account at make.com. The free plan includes 1,000 operations per month, which is enough for most small-to-medium workflows.
Connect Your Webhook
In your DangWire dashboard, copy your webhook URL. In Make, create a new scenario and add a 'Webhook' module as the trigger. Paste the webhook URL and click 'OK'.
Import the Workflow Template
Download the .json workflow file from your DangWire order confirmation. In Make, click the three-dot menu on your scenario, select 'Import Blueprint', and upload the file.
Configure Mappings
Map the incoming webhook data fields to your Make modules (Google Sheets, Airtable, etc.). Each field is labeled in the template — just match the labels to your app's fields.
Test the Workflow
Click 'Run once' in Make, then submit a test form. Verify the data flows through each module correctly. Check the execution log for any errors.
Activate the Workflow
Once tests pass, toggle your scenario to 'ON' in Make. Your automation is now live and will run automatically on each new form submission.
Verify webhook signatures
Every forward DangWire sends to your automation URL is HMAC-signed so you can prove it came from us and was not tampered with in transit. The dashboard Test button sends the exact same signed shape, so you can validate your verification logic before going live. Verification is optional — unsigned requests are still delivered — but recommended for production endpoints.
| Header | Meaning |
|---|---|
X-Webhook-Signature | Hex-encoded HMAC-SHA256 digest over `{timestamp}.{raw_body}` using your workflow's signing secret. |
X-Webhook-Timestamp | Unix seconds (string) when the request was signed. Reject anything older than 5 minutes to block replays. |
X-Webhook-Event | Event type — `form_submission` for live submissions and manual test probes alike. |
Verification recipe
- Read the raw request body before JSON parsing — the signature covers the exact bytes on the wire.
- Compute
expected = HMAC_SHA256(secret, timestamp + "." + raw_body)and compare it toX-Webhook-Signaturein constant time. - Reject when
X-Webhook-Timestampis more than 5 minutes old (replay window) or the digest does not match.
import { createHmac, timingSafeEqual } from "crypto";
function verifyDangWire(secret, rawBody, timestamp, signature) {
const expected = createHmac("sha256", secret)
.update(timestamp + "." + rawBody)
.digest("hex");
const ok = timingSafeEqual(
Buffer.from(expected, "hex"),
Buffer.from(signature, "hex"),
);
const fresh = Math.abs(Date.now() / 1000 - Number(timestamp)) <= 300;
return ok && fresh;
}Your signing secret (whsec_…) is per workflow. Read it once from the dashboard integration settings or the management API (GET /api/webhook-signing/workflows/<id>), store it in your platform's credential vault, and rotate it there when needed (POST …/rotate) — rotation invalidates old signatures immediately.