The short answer

If you would rather not write a webhook receiver, point Rexa at an automation platform’s inbound webhook URL and build the rest visually. One thing decides whether this works properly: signature verification needs the exact bytes Rexa sent, so use the trigger variant that hands you the unparsed body. A tool that re-serialises the JSON first will make a valid signature look invalid.

Last reviewed

What am I actually connecting?

A generic webhook endpoint, nothing more. Create an inbound webhook in your automation platform, copy its URL, add it as an endpoint in Rexa and subscribe it to the events the workflow needs. Rexa then POSTs a JSON envelope containing an `id`, the event `type`, your `tenant_id`, a `created_at` timestamp and a `data` object.

There is no Rexa app to install in any of these platforms. That is worth saying plainly, because a marketplace listing is what most people picture when they hear "Zapier integration".

How do I verify the signature inside a no-code tool?

Rexa signs each request with HMAC-SHA256 over the timestamp, a literal full stop, and the body, and sends the result as `X-Webhook-Signature: sha256=<hex>` alongside `X-Webhook-Timestamp` in unix seconds. Verification is byte-exact on the body.

That is the constraint that shapes the whole setup. Most automation platforms offer two flavours of inbound webhook: one that parses the JSON for you and one that hands over the raw request. Choose the raw one, hash exactly those bytes, and reject anything more than five minutes away from the current time so a captured request cannot be replayed. If your platform genuinely cannot expose the raw body, treat the endpoint URL as the only thing protecting the workflow and keep it out of shared documents.

What should I know about retries and ordering?

A workflow that errors or times out will be retried on Rexa’s fixed curve — 30 seconds, 1 minute, 5, 15, an hour, 3, 6, 12 and 24 hours, nine attempts across roughly 48 hours. Make the workflow idempotent on the envelope `id`, because that id identifies the event rather than the attempt and will repeat.

Delivery order is not arrival order. Events that are only actionable while a call is live — a mid-call sentiment change, or a transfer being initiated — are queued at higher priority and overtake ordinary lifecycle events. Separately, an account carrying a large backlog is progressively deprioritised so one busy tenant cannot starve another. This changes ordering only; no delivery is ever dropped to make room.

Can the automation platform start a call?

Yes, and this is the half people forget. Every one of these tools can make an outbound HTTP request, so a workflow can call Rexa’s REST API with an API key to place a call, exactly as your own code would. A form submission in one tool becomes a phone call a second later without anything custom in between.

Frequently asked questions

Is there a Rexa app in the Zapier directory?
No, and there is no Make app or n8n node either. The integration is a plain webhook you point at the platform’s inbound URL. That is more setup than installing an app and considerably less likely to break when either side ships a change.
Why does my signature check fail even though the secret is right?
Almost always because the body was parsed and re-serialised before you hashed it. The signature covers the exact bytes Rexa sent, so a re-ordered key or a whitespace difference breaks it. Switch to the trigger variant that gives you the raw request body.
How do I stop a workflow running twice on the same call?
Deduplicate on the `id` in the event envelope. It identifies the event, not the delivery attempt, so a retry after your workflow timed out arrives carrying an id you have already seen. Store processed ids and exit early on a repeat.

Scope, limitations, and sources

There is no Rexa app in the Zapier directory, no Make app and no n8n community node — nothing to install, and no pre-mapped fields. You are wiring a generic webhook, which means you own the field mapping and the error handling. Signature verification can be awkward inside a no-code step and impossible in a few; where it is impossible the endpoint URL is the only secret protecting the workflow, which is materially weaker than a verified signature. Rexa’s view of your workflow stops at the HTTP status your platform returns, so a step that fails after the webhook was acknowledged looks like a success here. And every platform has its own task or operation quota — a busy campaign can consume one quickly.

Sources

  • Outbound webhook event catalog, signature headers and the delivery retry schedule. rexa.ai (accessed )
  • Placing calls over the REST API, including selecting a preferred provider. rexa.ai (accessed )

Spotted something out of date or wrong? Tell us on the contact page and we will correct it and update the review date.