Skip to content
Sign in

Masnet is used on a computer. You can create your account from your phone and sign in from your desktop.

Developers

Receive Masnet events in Make

Make receives the event with a custom webhook. The documentation consulted does not confirm that Make delivers the exact bytes of the body or offers an HMAC function; this guide states so and proposes alternatives.

On this page

Requirements in Masnet

Before configuring the receiving system, prepare the destination in Masnet. The steps are the same for every system.

  1. Open Company › Integrations (the Spanish interface labels it Empresa › Integraciones), go to the Destinations tab and select New destination. If the integration has no authorized data yet, Masnet asks you to authorize it first.
  2. In Destination address (https) enter the receiver public URL. It must be https, port 443 or 8443 and a public DNS name: user information in the URL, fragments, IP addresses and internal names are not accepted. A query string is allowed; Masnet treats the whole URL as a credential.
  3. In Format choose Standard JSON (application/json) or Structured CloudEvents (application/cloudevents+json). The event content is the same; see Webhooks.
  4. Select Create destination. Masnet shows the signing secret (whsec_…) only once. Store it immediately in the receiver secret store; it cannot be read again.
  5. Select Test destination and then Send test. The integration is activated only after a successful test; then use Activate destination.

Scenario configuration

  1. Create a scenario with the Custom webhook module and add a webhook. Copy its URL into Destination address (https) in Masnet; the webhook URL is a credential.
  2. In the module advanced settings, enable Get request headers to read webhook-id, webhook-timestamp and webhook-signature.
  3. The module has the JSON pass-through option, which delivers the JSON as a text string instead of separate fields.
  4. To respond, add a Webhook response module with Status 200. Without that module, Make answers 200 "Accepted" when the event is queued.

Signature verification

The signature is v1, followed by base64(HMAC-SHA256) computed with the binary key obtained by base64-decoding what follows whsec_, over the bytes webhook-id + . + webhook-timestamp + . + the exact body. Always verify over the received bytes, before parsing the JSON.

  • Verified in the Make documentation: the request headers option, the option to deliver the JSON as text and the response module exist.
  • Not verified: that the delivered text is identical, byte for byte, to the received body, and that Make has an HMAC-SHA256 function with a base64 key. Do not assume it.
  • How to proceed: run a test with the test event and compare the computed signature with the received one. If it does not match, or if you cannot compute the HMAC, delegate verification to a service of your own with the Node.js or Python guide and let Make receive only events already verified.
  • In the meantime: configure an additional credential on the Masnet destination (for example, Header with API key) and require it in the scenario if Make allows it. Note that Make reserves the x-make-apikey header and its value does not reach the scenario.

Response

If you add the Webhook response module, Make may take up to 180 seconds to answer when the scenario does not finish, far more than the 15 seconds of Masnet. Keep the scenario short or respond with the module as early as possible.

Testing with the test event

  1. Run the scenario in the mode that waits for data.
  2. In Masnet, select Test destination and Send test.
  3. Make learns the data structure from that first request; confirm that it recognizes data and id.

Operation: duplicates and ordering

  • Idempotency. webhook-id identifies the event and is kept across retries and redeliveries. Record the identifiers already processed and discard repeats with a 2xx response.
  • Ordering. Each resource (subject) carries an increasing sequence. Discard an event whose sequence is lower than or equal to the last one applied for that subject. Events of different resources have no order between them.
  • Retries. Masnet retries any non-2xx response for up to 72 hours; the full schedule is in Webhooks.
  • Secret rotation. When rotating with overlap, the previous secret stays valid for 24 hours and webhook-signature carries two v1,… signatures separated by a space. Accept the event if either one matches.

Troubleshooting

Masnet records the response code of each attempt in the delivery history. These are the effects of each receiver response:

Receiver responses and their effect
Receiver responseEffect in Masnet
2xxSuccessful delivery. It means receipt, not business processing.
3xxThe redirect is not followed. It counts as a failure and is retried; the history shows the Location without its query string.
400, 401, 403, 404 and other 4xx or 5xxRetryable failure for up to 72 hours from the start of the delivery cycle.
410Masnet disables the destination and cancels pending deliveries. Return 410 only if the destination must stop receiving events.
413The event is marked as undeliverable to that destination and is not retried.
429 or 503 with Retry-AfterRetry-After (seconds or HTTP date) is honored up to a maximum of 1 hour.
No response within 15 secondsTimeout (5 s to connect, 15 s in total). It is a retryable failure: answer 2xx and process asynchronously.
Make answers 400 "Queue is full."The webhook queue is full. Masnet retries it; review the plan and the consumption of your scenario.