Zapier Setup Guide
Follow these 6 steps to activate your DangWire automation on Zapier.
Create a Zapier Account
Sign up for a free Zapier account at zapier.com. The free plan includes 100 tasks/month and 5 Zaps, which is enough for testing and small automations.
Set Up the Webhook Trigger
In your DangWire dashboard, copy your webhook URL. In Zapier, create a new Zap and search for 'Webhooks by Zapier'. Select 'Catch Hook' as the trigger event and paste the webhook URL into your form's webhook settings.
Follow Your Delivered Setup Instructions
Zapier has no Zap import file. Use the step-by-step setup instructions delivered with your DangWire order (or the white-label Workflow API build) to configure each action step manually in the Zap editor, following the provided field mapping.
Configure Action Steps
Add each action step from your DangWire template (Google Sheets, Airtable, Email, etc.). Map the webhook data fields using the 'Data' section from the webhook trigger output. Each field is clearly labeled.
Test the Zap
Click 'Test and review' in Zapier, then submit a test form. Verify the data appears correctly in your connected apps. Check each step's output for any field mapping errors.
Turn On the Zap
Once tests pass, toggle the Zap to 'On'. Your automation is now live and will run automatically on each new form submission.
Verify webhook signatures
Every forward DangWire sends to your automation URL is HMAC-signed so you can prove it came from us and was not tampered with in transit. The dashboard Test button sends the exact same signed shape, so you can validate your verification logic before going live. Verification is optional — unsigned requests are still delivered — but recommended for production endpoints.
| Header | Meaning |
|---|---|
X-Webhook-Signature | Hex-encoded HMAC-SHA256 digest over `{timestamp}.{raw_body}` using your workflow's signing secret. |
X-Webhook-Timestamp | Unix seconds (string) when the request was signed. Reject anything older than 5 minutes to block replays. |
X-Webhook-Event | Event type — `form_submission` for live submissions and manual test probes alike. |
Verification recipe
- Read the raw request body before JSON parsing — the signature covers the exact bytes on the wire.
- Compute
expected = HMAC_SHA256(secret, timestamp + "." + raw_body)and compare it toX-Webhook-Signaturein constant time. - Reject when
X-Webhook-Timestampis more than 5 minutes old (replay window) or the digest does not match.
import { createHmac, timingSafeEqual } from "crypto";
function verifyDangWire(secret, rawBody, timestamp, signature) {
const expected = createHmac("sha256", secret)
.update(timestamp + "." + rawBody)
.digest("hex");
const ok = timingSafeEqual(
Buffer.from(expected, "hex"),
Buffer.from(signature, "hex"),
);
const fresh = Math.abs(Date.now() / 1000 - Number(timestamp)) <= 300;
return ok && fresh;
}Your signing secret (whsec_…) is per workflow. Read it once from the dashboard integration settings or the management API (GET /api/webhook-signing/workflows/<id>), store it in your platform's credential vault, and rotate it there when needed (POST …/rotate) — rotation invalidates old signatures immediately.