Pabbly Setup Guide
Follow these 6 steps to activate your DangWire automation on Pabbly Connect.
Create Your Pabbly Connect Account
Sign up at pabbly.com/connect. The free plan includes 100 tasks/month — enough for testing and small automations — and paid plans cap nothing per task.
Open Your Delivery Email
Your Pabbly automation arrives by email with the workflow JSON and an automation link. Download the JSON attachment and keep the email for reference.
Import the Workflow
In Pabbly Connect, create a new workflow and upload the delivered workflow JSON (or open the automation link from the email, which preloads the template).
Connect Your Apps
Authorize each app the workflow touches (Google Sheets, email, CRM, …) when Pabbly prompts on first save. Every step in the template is labeled with its target app.
Test the Workflow
Use Pabbly's Test & Execute with a sample payload, then submit a real test form. Verify data lands in each connected app with correct field mapping.
Activate the Workflow
Save and toggle the workflow to active. Every new form submission now runs through the Pabbly automation automatically.
Pabbly status callbacks (optional)
Ask Pabbly to POST build and delivery status back to DangWire so your order progress updates in real time. Callbacks are authenticated — unauthenticated requests are rejected in production.
- 1
Point Pabbly at the callback URL
Configure the webhook or HTTP action to POST to:
https://dangwire.com/platform-callbacks/pabbly - 2
Authenticate the callback
Add a custom header to the webhook or HTTP action request — every Pabbly HTTP step supports custom headers:
X-Webhook-Secret: <your secret>Your secret is any long random string you choose (keep it identical on both sides).
- 3
Mirror the secret on DangWire
Set
PABBLY_WEBHOOK_SECRETto the same value. Leave it unset on local dev (callbacks are accepted with a warning); production rejects callbacks without it.
Verify webhook signatures
Every forward DangWire sends to your automation URL is HMAC-signed so you can prove it came from us and was not tampered with in transit. The dashboard Test button sends the exact same signed shape, so you can validate your verification logic before going live. Verification is optional — unsigned requests are still delivered — but recommended for production endpoints.
| Header | Meaning |
|---|---|
X-Webhook-Signature | Hex-encoded HMAC-SHA256 digest over `{timestamp}.{raw_body}` using your workflow's signing secret. |
X-Webhook-Timestamp | Unix seconds (string) when the request was signed. Reject anything older than 5 minutes to block replays. |
X-Webhook-Event | Event type — `form_submission` for live submissions and manual test probes alike. |
Verification recipe
- Read the raw request body before JSON parsing — the signature covers the exact bytes on the wire.
- Compute
expected = HMAC_SHA256(secret, timestamp + "." + raw_body)and compare it toX-Webhook-Signaturein constant time. - Reject when
X-Webhook-Timestampis more than 5 minutes old (replay window) or the digest does not match.
import { createHmac, timingSafeEqual } from "crypto";
function verifyDangWire(secret, rawBody, timestamp, signature) {
const expected = createHmac("sha256", secret)
.update(timestamp + "." + rawBody)
.digest("hex");
const ok = timingSafeEqual(
Buffer.from(expected, "hex"),
Buffer.from(signature, "hex"),
);
const fresh = Math.abs(Date.now() / 1000 - Number(timestamp)) <= 300;
return ok && fresh;
}Your signing secret (whsec_…) is per workflow. Read it once from the dashboard integration settings or the management API (GET /api/webhook-signing/workflows/<id>), store it in your platform's credential vault, and rotate it there when needed (POST …/rotate) — rotation invalidates old signatures immediately.