Connect Dazza to your own system by webhook

A workflow can call your own system: look up an order, check stock, read an account. Dazza sends the details as a signed JSON request and answers the customer with what comes back.

On Shopify, you don’t need this for orders: connect your shop instead. To hear about conversations as they happen, rather than when a workflow runs, use event webhooks.

Set it up

In a workflow, choose Call your system and enter Your system’s address. Any web address that accepts a POST works, including webhook URLs from Zapier (Catch Hook), Make (Custom webhook) and n8n (Webhook node).

Zapier’s Catch Hook always sends the same fixed reply, so it can start a Zap but can’t send an answer back. To look something up and answer with it, use Make’s Webhook response module, n8n’s Respond to Webhook node, your own API, or connect Zapier’s MCP server instead.

For anything about a customer’s own account, turn on Customer verifies their email first. See Verify your customers.

What Dazza sends

POST https://your-system.example/dazza
content-type: application/json
x-dazza-event: action.run
x-dazza-timestamp: 1792860533
x-dazza-signature: sha256=9f2c…

{
  "event": "action.run",
  "action": { "id": "act_…", "name": "Check an order" },
  "run": { "id": "run_…", "test": false },
  "inputs": { "order_number": "2048" },
  "conversation": { "id": "…", "pageUrl": "https://hollis.co/orders" },
  "customer": {
    "email": "jamie@example.com",
    "name": "Jamie",
    "verified": { "email": "jamie@example.com", "via": "code", "userId": null }
  },
  "sentAt": "2026-10-24T10:42:00.000Z"
}

inputs holds the details the workflow collected, by their keys. customer.verified is only set when Dazza has proof of who the customer is: via is code, signed or sender. Otherwise it’s null, and you shouldn’t return anything private.

run.test is true for Send a test and runs in your preview.

Check the signature

Each workflow has its own secret. Dazza signs the timestamp and the raw body with it, so you can be sure the request came from Dazza and wasn’t changed:

import crypto from "node:crypto";

const expected = "sha256=" + crypto
  .createHmac("sha256", process.env.DAZZA_SECRET)
  .update(`${req.headers["x-dazza-timestamp"]}.${rawBody}`)
  .digest("hex");

if (!crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(req.headers["x-dazza-signature"]))) {
  return res.status(401).end();
}

Reject requests with an old timestamp too, so a request can’t be replayed later.

Reply

Reply with JSON. If it has a message, that’s what Dazza tells the customer, in its own words and tone. Any other data is read too, so you can return the facts and let Dazza explain them:

{ "message": "Order 2048 left our warehouse today and arrives tomorrow, 9am to 1pm." }

Test it

Send a test in the workflow editor sends sample details, marked as a test, and shows what your system replied.