Zapier / Make.com / n8n Integration Guide

Overview

Orbyt's webhook system sends real-time notifications when events happen in your pipeline: new jobs added, status changes, offers received, interviews scheduled, and more. Connect these webhooks to Zapier, Make.com, or n8n to build powerful automations.

Prerequisites

• Orbyt Ultra plan
• An Orbyt API key with read-write permissions
• A Zapier, Make.com, or n8n account

Webhook Events

Orbyt can send webhooks for these events:

Setting Up with Zapier

Step 1: Create a Zap with Webhook Trigger

1. Log in to Zapier and click Create Zap
2. For the trigger, search for Webhooks by Zapier
3. Select Catch Hook as the trigger event
4. Zapier gives you a webhook URL like: https://hooks.zapier.com/hooks/catch/123456/abcdef/
5. Copy this URL

Step 2: Register the Webhook in Orbyt

Use the Orbyt API to register Zapier's webhook URL:

curl -X POST https://www.orbytlabs.ai/api/mcp/webhooks \
  -H "Authorization: Bearer ext_your_token" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://hooks.zapier.com/hooks/catch/123456/abcdef/",
    "events": ["job.status_changed", "offer.received", "interview.scheduled"],
    "secret": "my_signing_secret"
  }'

Step 3: Send a Test Event

curl -X POST https://www.orbytlabs.ai/api/mcp/webhooks/test \
  -H "Authorization: Bearer ext_your_token" \
  -H "Content-Type: application/json" \
  -d '{ "webhookId": "wh_abc123" }'

Go back to Zapier and click Test trigger to confirm the test event was received.

Step 4: Add Actions

Now add actions to your Zap. Popular combinations:

Setting Up with Make.com

Step 1: Create a Scenario

1. Log in to Make.com and create a new scenario
2. Add a Webhooks module as the trigger
3. Select Custom webhook
4. Make gives you a URL like: https://hook.make.com/abc123xyz

Step 2: Register the Webhook

Same as Zapier, use the API to register the Make webhook URL:

curl -X POST https://www.orbytlabs.ai/api/mcp/webhooks \
  -H "Authorization: Bearer ext_your_token" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://hook.make.com/abc123xyz",
    "events": ["job.created", "job.status_changed"],
    "secret": "my_make_secret"
  }'

Step 3: Build Your Flow

Make.com's visual builder lets you:

• Filter events by type (only act on offer.received)
• Route to different actions based on job status
• Transform data before sending to other services
• Iterate over arrays (e.g., multiple contacts on a job)

Setting Up with n8n

Step 1: Add a Webhook Node

1. Open your n8n instance
2. Add a Webhook node as the trigger
3. Set the HTTP method to POST
4. Copy the production webhook URL

Step 2: Register and Connect

Register the n8n webhook URL using the same API call pattern above. Then add downstream nodes for your automation logic.

Webhook Payload Format

All webhooks are sent as POST requests with this structure:

{
  "event": "job.status_changed",
  "timestamp": "2026-03-29T14:30:00.000Z",
  "data": {
    "id": "job_abc123",
    "company": "Stripe",
    "title": "Senior Frontend Engineer",
    "status": "interviewing",
    "previousStatus": "applied"
  }
}

Webhook Security

Every webhook you registered with a secret carries three headers:

The signature is an HMAC-SHA256 of the raw request body, hex encoded, keyed with the secret you set when you registered the webhook. The header value is that hex digest with a literal sha256= in front of it, the same convention GitHub and Stripe use.

// Node. Compare against the header WITHOUT the prefix.
import { createHmac, timingSafeEqual } from "node:crypto";

function verify(rawBody, header, secret) {
  const expected = createHmac("sha256", secret).update(rawBody).digest("hex");
  const received = String(header).replace(/^sha256=/, "");
  if (received.length !== expected.length) return false;
  return timingSafeEqual(Buffer.from(received), Buffer.from(expected));
}

Two things that will bite you if you skip them. Hash the raw body bytes, not a re-serialized object: JSON.parse then JSON.stringify can reorder keys or change spacing, and the digest will not match. And compare in constant time, because a plain === on a signature leaks the correct value one byte at a time.

Managing Webhooks

# List all registered webhooks
curl https://www.orbytlabs.ai/api/mcp/webhooks \
  -H "Authorization: Bearer ext_your_token"

# Delete a webhook
curl -X DELETE https://www.orbytlabs.ai/api/mcp/webhooks \
  -H "Authorization: Bearer ext_your_token" \
  -H "Content-Type: application/json" \
  -d '{ "webhookId": "wh_abc123" }'

Automation Ideas

Tips

• Register webhooks for specific events rather than all events to reduce noise
• Always set a secret when creating webhooks and verify signatures in your automation
• Use Orbyt's test endpoint to verify your automation works before relying on real data
• Maximum 10 webhooks per user
• Your endpoint has 5 seconds to answer. We abort the request at 5 seconds, so if your handler does real work, acknowledge with a 2xx first and process afterwards. Zapier, Make and n8n already do this for you.
• A redirect is a failure, not a hop. We send with redirect: "manual", so a 301 or 302 from your endpoint is recorded as the answer and never followed. Register the final URL. Stripe and GitHub behave the same way, and the reason is that following a redirect would let an endpoint bounce us to an address our SSRF check never saw.
• Webhook URLs must resolve to a public address. Every A and AAAA record is checked and the socket is pinned to the validated address, so localhost, 10.x, 192.168.x and link-local targets are refused. Use a tunnel (ngrok, Cloudflare Tunnel) when testing locally.