Automate Chockstone with n8n, Make and Zapier

What you can trigger on

A webhook listens for the events you pick. This table is made from the list the server sends from, so it names every event and nothing else.

How to connect a tool

1. In your tool, make a trigger that receives POST calls and copy its address. In n8n that is the Webhook node's Production URL. In Make it is a Custom webhook, and in Zapier it is Webhooks by Zapier with a Catch Hook trigger.
2. In the Chockstone app, make an API key under Agents with the admin permission. Owners and admins manage webhooks.
3. Create the webhook with the API, or ask a connected assistant to run webhook_create. The answer holds the signing secret. Chockstone shows it once, so store it in your tool now.
4. Send a test. POST /api/v1/webhooks/{id}/test sends a ping event and returns what your server answered.

curl -X POST https://chockstonelabs.com/api/v1/webhooks \
  -H "Authorization: Bearer $CHOCKSTONE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://your-tool.example/webhook/abc","events":["link.signup","post.published"]}'

Add "workspace":"your workspace id" when the key reaches more than one workspace. Chockstone calls your address on each event from then on. Turn on include_text only if you want the words people wrote.

The webhook endpoints

• POST /api/v1/webhooks creates one and returns the secret once.
• GET /api/v1/webhooks lists them. The secret is never listed.
• PATCH /api/v1/webhooks/{id} changes the address, events, active or include_text.
• DELETE /api/v1/webhooks/{id} removes one and its delivery log.
• POST /api/v1/webhooks/{id}/test sends a ping.
• GET /api/v1/webhooks/{id}/deliveries shows the last 50 deliveries with their status.
• POST /api/v1/webhooks/{id}/rotate-secret makes a new secret and ends the old one at once.

Check the signature

Every call has four headers: Chockstone-Event, Chockstone-Delivery, Chockstone-Timestamp (Unix seconds) and Chockstone-Signature. The signature is sha256= and then the hex HMAC-SHA256 of the timestamp, a dot and the raw request body, with your secret as the key.

Refuse a call when the signature does not match or when the timestamp is more than 300 seconds from your clock. Use the body exactly as received, before a JSON parser touches it.

JavaScript

import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyChockstone(rawBody, headers, secret, toleranceSeconds = 300) {
  const timestamp = headers["chockstone-timestamp"];
  const signature = headers["chockstone-signature"] ?? "";
  if (!timestamp || Math.abs(Date.now() / 1000 - Number(timestamp)) > toleranceSeconds) return false;
  const expected = "sha256=" + createHmac("sha256", secret).update(`${timestamp}.${rawBody}`).digest("hex");
  const a = Buffer.from(expected), b = Buffer.from(signature);
  return a.length === b.length && timingSafeEqual(a, b);
}

Python

import hashlib
import hmac
import time


def verify_chockstone(raw_body: bytes, headers: dict, secret: str, tolerance_seconds: int = 300) -> bool:
    timestamp = headers.get("Chockstone-Timestamp", "")
    signature = headers.get("Chockstone-Signature", "")
    try:
        if abs(time.time() - int(timestamp)) > tolerance_seconds:
            return False
    except ValueError:
        return False
    message = timestamp.encode() + b"." + raw_body
    expected = "sha256=" + hmac.new(secret.encode(), message, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature)

A recipe for n8n

1. Add a Webhook node, set the HTTP method to POST and copy its Production URL into Chockstone. The Test URL works only while the editor is listening, so use the Production URL and activate the workflow.
2. Add a Code node that checks the signature. n8n Cloud has the Node.js crypto module in the Code node. A self-hosted n8n needs NODE_FUNCTION_ALLOW_BUILTIN=crypto.
3. Add a Switch node on {{ $json.type }} with one output for each event you handle, or an If node when you handle one.

The Code node, ready to paste:

const crypto = require('crypto');

// Paste the secret Chockstone showed you when you created the webhook.
const secret = 'whsec_PASTE_YOUR_SECRET_HERE';

const item = $input.first().json;
const timestamp = item.headers['chockstone-timestamp'] || '';
const given = item.headers['chockstone-signature'] || '';
// Chockstone writes the body with JSON.stringify, so writing the parsed body back gives the same bytes.
const body = JSON.stringify(item.body);
const expected = 'sha256=' + crypto.createHmac('sha256', secret).update(timestamp + '.' + body).digest('hex');
const a = Buffer.from(expected);
const b = Buffer.from(given);
const fresh = Math.abs(Date.now() / 1000 - Number(timestamp)) <= 300;
if (!fresh || a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
  throw new Error('Chockstone signature check failed');
}
return [{ json: item.body }];

A finished workflow is ready to import: n8n-link-signup.json. The workflow receives the call, checks the signature, keeps only link.signup and adds a row to a Google Sheet. After importing, paste your secret, set your spreadsheet and choose your Google credential. The row holds the email hash, because the webhook does not send addresses unless include_text is on.

Make and Zapier

In Make, start a scenario with the Webhooks app's Custom webhook, copy its address and give it to Chockstone. In Zapier, start a Zap with Webhooks by Zapier and the Catch Hook trigger, and do the same. Each receives the JSON body and the four headers.

Checking the signature needs the raw body and the headers in one step. Where a step can run code and read both, use the check above. Where it cannot, treat the address as a secret, leave include_text off and rotate the webhook if the address leaks.

Calling Chockstone back

Webhooks send events out. To act on them, call Chockstone. Every action is a REST endpoint under https://chockstonelabs.com/api/v1/, described in OpenAPI at /api/v1/openapi.json and called with an API key as a Bearer token. The HTTP Request node in n8n, Make and Zapier can call any of them.

n8n has an MCP Client node that connects to an MCP server and uses its tools as workflow steps. Point it at https://chockstonelabs.com/mcp and use an API key as the Bearer token. The tools are listed on Chockstone MCP tools.

Limits and retries

• Endpoints per space: Starter 1, Creator 5, Studio 25. An endpoint that is switched off still counts.
• Chockstone waits 10 seconds for your answer. Any 2xx status counts as received. Anything else, a timeout or a redirect is a failure.
• A failed call is tried again after 1 minute, 5 minutes, 30 minutes, 2 hours and 12 hours: 6 tries in all. After the last one the delivery is marked dead.
• 20 dead deliveries in a row turn the endpoint off and send a notification to the people in the workspace. Turning it back on clears the count.
• One request at a time goes to each endpoint. Order is not guaranteed, so use created_at if order matters.
• The last 200 deliveries of each endpoint are kept, with the status your server returned and how long it took.

A call can arrive twice, for example when your server answers after the 10 seconds. Chockstone-Delivery is the same on every try of one delivery, so keep the ones you have handled. The event id in the body is unique to the event.

What is never sent

Events carry ids, status, times, the network, account handles and links. They leave out captions, post titles, comment and message text, the names of commenters and senders, and email addresses.

A webhook can turn on include_text to add the fields the table marks as only with include_text. New webhooks start with it off. link.signup always carries a hash of the email, which lets you match a signup against your own list without receiving the address.

Security

• Chockstone encrypts the secret at rest and shows it once. Keep it out of source control and rotate it if it leaks. The old secret stops working at once.
• The address must be a public https address. Chockstone refuses private networks, addresses with a user name or password, and redirects.
• The signature shows that Chockstone sent the call and that nobody changed it. Check it, and check the timestamp, before you act.
• Only owners and admins with the admin permission can create, change or delete webhooks, and every change shows in Activity.