Does every webhook cost me a turn?

Only the ones that pass the event filter. A delivery for an event the trigger does not listen for is recorded and dropped before any model runs, which is why naming the events you care about matters.

What happens if the same event arrives twice?

It is handled once. Qoren recognises a repeat and returns the first result, so a service retrying after a slow response does not book the same meeting into your CRM twice.

Can someone who guesses the URL wake my agent?

Not for a source that signs its webhooks: a delivery without a valid signature is refused before the agent is involved. If you choose the unsigned option, the URL is the only credential, which is why the console says so plainly when you pick it.

What if the service I use is not listed?

Choose the custom source and name the header its signature arrives in. Qoren checks it as an HMAC-SHA256 of the body, and you can set base64 encoding or a prefix if that service does it differently.

qoren.

Docs · Webhooks

Let an event wake your agent.

A schedule wakes an agent at a time you picked. A webhook trigger wakes it at the moment something happens: a meeting gets booked, a pull request opens, a payment clears. You paste a URL and a secret into the other service, write what the agent should do, and it handles each event as it arrives.

What a trigger is

A trigger is three things kept together: a URL the outside service posts to, the events you want to act on, and the rules you wrote for them. It belongs to one agent, so the agent handling your bookings can be a different agent from the one watching your repository.

Setting one up

Everything happens on the agent's Triggers tab, or through the CLI.

1Add a triggerOpen the agent, go to Triggers, and choose where the event comes from: cal.com, GitHub, Stripe, or any service that signs its webhooks.
2Pick the eventsTick only the ones you want to act on. cal.com alone can send more than twenty different event types, and every delivery that reaches the agent is a turn you pay for.
3Write the rulesSay what the agent should do when it fires, in plain language. This goes to the agent ahead of the event, alongside everything it already knows.
4Copy the URL and secretBoth are shown once, when you create the trigger. Paste them into the other service's webhook settings and save.

How a delivery is checked

Qoren verifies each delivery against the secret before anything runs, using whichever scheme the sender uses. A body that was altered in transit, or signed with a different secret, is refused and never reaches the agent.

cal.com signs the body and sends the result in x-cal-signature-256.
GitHub does the same in x-hub-signature-256, prefixed with its algorithm.
Stripe signs a timestamp with the body and rejects anything older than five minutes.
Any other service can be wired up by naming the header its signature arrives in.

What the agent is told

The prompt has three parts, in this order: which trigger fired and what event it was, your rules for that trigger, and the payload itself. The payload is labelled as data from a stranger, because that is what it is: a webhook body is written by whoever booked the meeting or opened the pull request. The agent is told to treat anything inside it as information to reason about, never as an instruction to follow.

How much it may do on its own

Each trigger sets this for itself.

Act: the agent handles the event like any other turn, and your existing approval settings still apply.
Propose only: the agent writes down what it would do and waits for you to approve it, which suits a trigger whose payload comes from people you do not know.

When nothing happens

The delivery log on each trigger records everything that arrives, including the deliveries that stopped before the agent ran, so a webhook that fired and did nothing always has an answer.

Ignored: the event is not one this trigger listens for.
Skipped: the account is out of credits, or paused by its own budget.
Throttled: over the trigger's hourly limit, which defaults to 60 deliveries.
Failed: the agent ran and something went wrong, or its environment was unreachable.

From the terminal

Everything the Triggers tab does is a CLI verb, so a trigger can be created and audited from a script.

Create a trigger and watch what arrives

qoren webhook create agt_abc --name "New bookings" --source cal \
  --event BOOKING_CREATED --event BOOKING_CANCELLED \
  --rules "Brief me on the attendee before the call."

qoren webhook deliveries whk_def
qoren webhook delivery whk_def dlv_123

Repeats and retries

Services retry a webhook when they do not get an answer quickly, so Qoren answers immediately and runs the agent afterwards. A retry of an event already handled is recognised and returns the original result rather than running the agent a second time.

Where each service puts its secret

What to look for in the other service's settings.

Service	Where the webhook is configured	Field for the secret
cal.com	Settings, Developer, Webhooks	Secret
GitHub	Repository or organization settings, Webhooks	Secret
Stripe	Developers, Webhooks	Signing secret, shown after you add the endpoint
Anything else	Wherever it lists outgoing webhooks	Name the header its signature arrives in

Frequently asked questions

No. The URL and the secret are shown once, when you create the trigger or rotate it, because the URL contains a token that works on its own. If you lose either, rotate the trigger and paste the new pair into the sending service.

See it with a real agent.

The fastest way to understand the flow is to deploy a template and watch its first run.

Start free trial