# Webhooks and automation

Understand event boundaries before connecting an external sender.

## Webhook availability

Nugget includes webhook receivers for specific integrations and workflows. This does not imply that every account has a generic outbound webhook subscription API.

Use only the URL, event contract and setup flow supplied for the particular integration you configure. Nugget does not publish a reusable signing secret or example callback credential.

## Verify incoming events

A receiver must authenticate the sender using the specific integration’s verification mechanism before processing an event. Treat payload fields as untrusted input.

Do not assume two integrations share a signing format. Verification, replay handling and event identifiers need to be defined per contract.

## Plan for delivery failures

Confirm the documented delivery and retry behavior before enabling an integration. Repeated delivery must not duplicate a consequential action.

When configuring automation, separate receipt of an event from successful completion of every action. Inspect available run information before triggering another attempt.

[Manage workflows in Nugget](https://usenugget.app/docs/guides/workflows)