Webhooks and credentials
Starting a flow from outside with a webhook, calling outside services from a flow, and keeping API keys for those calls in the credentials manager.
Inbound: start a flow from another system
Give a flow the trigger type webhook and it receives an address of the form:
POST https://kreastack.com/webhook?flow=<flow key>&token=<webhook token>Whatever is posted — JSON or form fields — is placed in the traveller's data under webhook (body, parsed JSON, query parameters, method, caller IP, headers) so later steps can use it. The response is JSON with the execution key. A wrong token is refused.
A run that is waiting on an async wait step is resumed the same way, with its resume address.
Outbound: call another system
- HTTP request step — any URL, method, headers and body; the response is kept in the data.
- Webhook trigger step — fire-and-forget to a URL with a payload.
Credentials
/credentials keeps the secrets those calls need — API keys, bearer tokens, header pairs — encrypted, and lets a step reference them by name so a key never sits in a flow definition. Create one, choose its type, paste the value once; the edit page never shows it again. Deleting a credential does not delete the steps that used it; they fail until pointed at another.
Provider keys
Keys for the platform's own integrations (Stripe, OpenAI, SendGrid…) are not credentials; they live in Integrations.