Power Automate Setup Guide
Follow these 6 steps to activate your DangWire automation on Microsoft Power Automate.
Check Your Microsoft Account
Power Automate is included with Microsoft 365 plans and free with a personal Microsoft account (powerautomate.microsoft.com). Sign in with the tenant that owns the target SharePoint/Teams/Outlook resources.
Open Your Delivery Email
Your Power Automate flow arrives by email with the flow JSON and an automation link. Download the JSON attachment and keep the email for reference.
Import the Cloud Flow
In Power Automate, open My flows → Import → Import solution (legacy) or upload the flow JSON per the delivered instructions. The flow lands in a disabled state until connections are configured.
Approve the Connector Consent Prompts
Open each connection reference (SharePoint, Outlook, Teams, Excel, …) and approve the consent dialog with an account that has access to the target resource. Expired or wrong-tenant connections are the most common failure.
Test the Flow
Use Test → Manually, then submit a test form. Check the flow run history for each step's input and output — every run is listed with per-step results.
Turn On the Flow
Once a test run completes green, save and turn the flow on. Every new form submission now triggers it automatically.
Power Automate status callbacks (optional)
Ask Power Automate to POST build and delivery status back to DangWire so your order progress updates in real time. Callbacks are authenticated — unauthenticated requests are rejected in production.
- 1
Point Power Automate at the callback URL
Configure the webhook or HTTP action to POST to:
https://dangwire.com/platform-callbacks/power_automate - 2
Authenticate the callback
Add a custom header to the webhook or HTTP action request — every Power Automate HTTP step supports custom headers:
X-Webhook-Secret: <your secret>Your secret is any long random string you choose (keep it identical on both sides).
- 3
Mirror the secret on DangWire
Set
POWER_AUTOMATE_WEBHOOK_SECRETto the same value. Leave it unset on local dev (callbacks are accepted with a warning); production rejects callbacks without it.
Verify webhook signatures
Every forward DangWire sends to your automation URL is HMAC-signed so you can prove it came from us and was not tampered with in transit. The dashboard Test button sends the exact same signed shape, so you can validate your verification logic before going live. Verification is optional — unsigned requests are still delivered — but recommended for production endpoints.
| Header | Meaning |
|---|---|
X-Webhook-Signature | Hex-encoded HMAC-SHA256 digest over `{timestamp}.{raw_body}` using your workflow's signing secret. |
X-Webhook-Timestamp | Unix seconds (string) when the request was signed. Reject anything older than 5 minutes to block replays. |
X-Webhook-Event | Event type — `form_submission` for live submissions and manual test probes alike. |
Verification recipe
- Read the raw request body before JSON parsing — the signature covers the exact bytes on the wire.
- Compute
expected = HMAC_SHA256(secret, timestamp + "." + raw_body)and compare it toX-Webhook-Signaturein constant time. - Reject when
X-Webhook-Timestampis more than 5 minutes old (replay window) or the digest does not match.
import { createHmac, timingSafeEqual } from "crypto";
function verifyDangWire(secret, rawBody, timestamp, signature) {
const expected = createHmac("sha256", secret)
.update(timestamp + "." + rawBody)
.digest("hex");
const ok = timingSafeEqual(
Buffer.from(expected, "hex"),
Buffer.from(signature, "hex"),
);
const fresh = Math.abs(Date.now() / 1000 - Number(timestamp)) <= 300;
return ok && fresh;
}Your signing secret (whsec_…) is per workflow. Read it once from the dashboard integration settings or the management API (GET /api/webhook-signing/workflows/<id>), store it in your platform's credential vault, and rotate it there when needed (POST …/rotate) — rotation invalidates old signatures immediately.