Triggers: let another system start a run

A trigger turns a saved flow into an endpoint. Anything that can POST JSON can start a run: Zapier or Make, a Shopify or Stripe webhook, a GitHub Action, a form backend, your own script. New order lands → listing copy is written. No one has to be in the app.

Creating one

Open the flow in the Builder and press Triggers, or click the webhook icon on its card on Workflows. Name what will be calling it, set the two caps, and press Create trigger.

You get a ready-to-paste curl with the secret shown once (it also goes to your clipboard). Store it in the sending system immediately — only a hash is kept here, so a lost secret is rotated, never recovered.

POST https://flowarray.app/api/triggers/<trigger-id>
X-FlowArray-Trigger: fatr_…
Idempotency-Key: <the sending system's event id>

{ "items": [ { "product_name": "Copper kettle", "product_image": "https://…/kettle.jpg" } ] }

Use the same column names your batch sheet uses. A single item can be sent as a bare object ({"product_name":"…"}), and a flow that fetches its own data accepts an empty body. The response carries the run id straight away, and the run appears in Runs badged Triggered.

What stops a trigger running up a bill

• A trigger secret can start exactly one workflow and read nothing — not your other flows, not your results, not your keys. That containment is the whole point of using a trigger rather than an API token for anything outside your control.
• Caps per trigger: 20 items per call and 10 runs per hour by default. Counted from real runs, so a chatty sender cannot outrun them.
• Repeat deliveries are free. Send an Idempotency-Key — most senders have an event id — and a retry returns the first run instead of starting a second. Senders retry often, including when they simply did not get an answer quickly enough, so this is worth setting.
• Pause or rotate at any time; the old secret dies immediately. A trigger also stops working if the person who created it leaves the workspace.
• The daily spend limit applies to triggered runs like any other.

Housekeeping

• Send the secret in the header, not the URL. URLs end up in logs, proxies and browser history.
• Recent deliveries on a trigger shows what each call did, with a link to the run it started — the first place to look when a sender says it fired and you cannot see a run.

Two variations

• The sender cannot use your column names? See mapping a raw payload.
• You want the outcome in the same call? Add ?wait=20 to the URL and FlowArray holds the response for up to 25 seconds, returning the run's status if it finishes in time ("finished": true). If it does not, you still get the run id and "finished": false — the run keeps going, so do not treat that as an error and do not retry. Most senders should skip this and use the run id.

Trigger or API token?

Use a trigger for anything outside your control — it can start one flow and read nothing. Use your own API token for your own scripts and agents, where you want the full surface.