A Zapier webhook is a web address that Zapier gives you. When another system sends an HTTP request to that address, Zapier starts a Zap with the data in the request. For an online store, that means an order, a newsletter sign-up, or a shipment can start work in other apps without anyone exporting a spreadsheet.
The setup takes a few minutes. The mistakes take longer to find: a Zap that runs twice for one order, a filter that lets test sign-ups into a real mailing list, or a public URL that anyone can post fake orders to. This guide covers the setup and the checks that prevent those problems.
Disclosure: Runner AI publishes this guide. The Zapier details come from Zapier’s webhook help page, and the signature details from the Svix verification guide, both retrieved on November 11, 2026. The Runner details come from the Runner webhooks guide and source code inspected on the same date. Plans, limits, and labels can change.
Key Takeaways
- Zapier’s webhook trigger is called Webhooks by Zapier. It needs a paid Zapier plan; the Free plan cannot use it.
- Use Catch Hook for most store events. Use Catch Raw Hook only when you need the request headers or the unparsed body.
- Send each Zapier URL only the events its Zap needs. One event type per Zap is easier to test and to fix.
- A Catch Hook does not verify who sent the request. Keep the URL private, and replace it if it leaks.
- Use the event’s unique ID to stop a repeated delivery from doing the same work twice.
How a Zapier webhook works
A webhook has two sides. The sender is the system where something happened, such as your store. The receiver is the address that gets told about it, here a Zapier URL.
- You create a Zap with the Webhooks by Zapier trigger. Zapier shows a URL that belongs to that Zap.
- You paste that URL into your store’s webhook settings and choose which events to send.
- When one of those events happens, the store sends a
POSTrequest with a JSON body to the URL. - Zapier answers with a
200status and runs the Zap’s actions with the fields from the body.
According to Zapier’s help page, the trigger is available on the Professional, Team, and Enterprise plans. Zapier accepts a payload of up to 10 MB, or 2 MB for Catch Raw Hook. If the body is a JSON array, Zapier runs the Zap once for each object in it.
Catch Hook or Catch Raw Hook?
| Trigger | What Zapier gives your Zap | Use it when |
|---|---|---|
| Catch Hook | The parsed JSON body as separate fields | You want to map fields such as the email or order total into the next step. This is the right choice for most store events. |
| Catch Raw Hook | The unparsed body (up to 2 MB) and the request headers | You need a header, such as a signature, or you want to process the body yourself in a code step. |
Start with Catch Hook. Switch only when a step needs something the parsed fields do not include.
Which store events to send
Most stores send a short list of events to Zapier. Each one maps to a common job.
| Store event | Common Zap |
|---|---|
| A shopper joins the newsletter | Add the contact to an email tool or CRM |
| An order is placed | Post to a team channel, add a row to a sheet, or create an invoice |
| An order ships | Send a tracking text or update a CRM record |
| A payment is refunded | Notify the bookkeeper or update the accounting tool |
| A product review is posted | Send the review to a support or marketing channel |
| A cart is abandoned | Start a follow-up in a tool your store does not already use |
Subscribe each Zapier URL to only the events its Zap needs. A Zap that receives every event has to filter most of them out, and its history becomes hard to read when something goes wrong. If your store already sends abandoned cart reminders itself, do not send cart.abandoned to a second tool as well, or shoppers can get two messages.
Set up a Zapier webhook from your store
The steps below use Runner’s webhooks, but the same order works for any store platform that lets you add a webhook endpoint. The example adds every new newsletter subscriber to a list in another email tool.
- Create the Zap. In Zapier, choose Webhooks by Zapier as the trigger app and Catch Hook as the event. Copy the URL Zapier shows.
- Add the endpoint in your store. In Runner, open Webhooks in your project and add an endpoint with the Zapier URL. Subscribe it only to
marketing_email.subscribed. - Send a real test event. Sign up on your storefront’s newsletter form with a test email address that you control.
- Test the trigger in Zapier. Zapier shows the request it received. In Runner, the body has the same envelope for every event:
type,apiVersion,eventId,timestamp,source, anddata. The email address is indata→email. - Add the action. Choose your email tool and its “create contact” action, and map the email to
data→email. - Filter before the action. Runner’s sign-up event includes
data→consentSource, which says where the shopper subscribed:storefront_newsletter,storefront_checkout, orstorefront_account_registration. Add a Zapier Filter step if you want only one of them. - Turn the Zap on, then check both sides. The test address should be in the email tool, and Runner’s webhook Logs should show a successful delivery to the Zapier URL.
Money amounts in Runner’s order events are whole numbers in the smallest unit of the currency. A total of 1250 in USD is $12.50. Add a Zapier Formatter step to divide by 100 before you write the amount to a sheet or invoice.
What a Catch Hook does not check
Anyone who knows a Catch Hook URL can send it a request, and Zapier will run the Zap. Zapier’s help page notes that the URL contains the owner’s Zapier ID and changes only when the Zap moves to another user. So a leaked URL stays usable until you replace it.
Signed webhooks solve this on the receiving side. Runner signs each delivery with the svix-id, svix-timestamp, and svix-signature headers. A receiver that checks the signature computes an HMAC with SHA-256 over the ID, the timestamp, and the unchanged body, and compares it with the header. A Catch Hook does none of this.
That leaves three practical rules:
- Keep the URL private. Do not paste it in a shared document, a support ticket, or a screenshot.
- Replace a leaked URL in both places. Create a new trigger URL in Zapier and update the endpoint in your store. Changing only one side breaks delivery.
- Verify when the action is risky. If the Zap issues refunds, changes stock, or sends money, receive the event in your own service, check the signature, and only then call Zapier or the other app. Catch Raw Hook plus a code step can read the headers, but the signing secret then has to live in your Zap.
Stop a Zap from running twice
Webhook senders retry when a delivery fails or times out, and you may resend an event while testing. Zapier runs the Zap every time a request arrives. For a sheet row that is an annoyance. For an invoice or a text message to a customer, it is a real error.
Use the event’s unique ID to prevent it. In Runner’s envelope, that is eventId. Before the action, add a lookup step that searches for that ID in your sheet or tool, and stop the Zap with a filter if it is already there. Then write the ID with the new record. Our webhook tester guide explains how to match a delivery attempt to the receiver’s record when you need to diagnose a duplicate.
Test before you trust it
A green Zap test proves that Zapier received one request. It does not prove that the whole job works. Before you rely on the Zap, check these four things:
- The right event arrived. The
typefield is the event you subscribed to, not a test event of another kind. - The fields are where you mapped them. Optional fields can be missing. An order with no shipping address, for example, should not break the Zap.
- The action happened once. Look in the destination app, not only in Zapier’s history.
- The sender and receiver agree. The store’s delivery log and Zapier’s history should show the same delivery.
Repeat the test after you change the endpoint, the events, or the Zap’s steps.
Related questions
What is a Zapier webhook?
A Zapier webhook is a URL created by the Webhooks by Zapier trigger. When another system sends an HTTP request to it, Zapier starts the Zap and passes the request’s data to the next steps.
Is the Zapier webhook trigger free?
No. Zapier’s help page lists Webhooks by Zapier on the Professional, Team, and Enterprise plans. The Free plan cannot use it.
What is the difference between Catch Hook and Catch Raw Hook?
Catch Hook parses the request body into fields you can map. Catch Raw Hook keeps the body unparsed, up to 2 MB, and also includes the request headers.
Does a Zapier webhook verify the sender?
No. A Catch Hook accepts any request sent to its URL. Keep the URL private, and verify the signature in your own service before any Zap that moves money or changes stock.
Can Runner AI send webhooks to Zapier?
Yes, in workspaces that show the Webhooks page. You add the Zapier URL as an endpoint and choose the events it receives. The Runner webhooks guide lists every event and its fields.
