Integrations / Webhooks
SerpDad + Webhooks: signed calls out to your system, and signed keyword lists in.
SerpDad webhooks work in both directions. Out: the Call a webhook and Create task blocks post signed JSON to an https URL you choose. In: a Webhook trigger starts a workflow when your system posts a signed keyword list to its secret URL. Every call is signed with HMAC-SHA256.
Sending a webhook costs nothing. Steps after an inbound call follow the same approval rules as any run.
Outbound. How SerpDad webhooks send to your system.
Call a webhook
Posts a signed JSON body to your URL, then passes the data on. Use it to feed your own dashboard, queue or CMS staging tool.
Create task, your way
The same signed call, shaped as a task with a title, assignee and due date. Use it for any task tool SerpDad does not connect to directly.
What the body holds
The workflow, the run and its link, the project, and what reached the step as counts and up to 25 names. Never keys, keyword lists or article text.
https only
The URL must be a public https address. SerpDad checks it when you save it and again on every send, and does not follow redirects.
A failed call is visible
Any answer other than a 2xx fails the step, so you see it in the run and can retry it.
Repeats you can drop
A retry carries the same delivery ID as the first try, so your endpoint can ignore a call it already handled.
Signing. Check the signature before you trust the call.
| Header | What it holds |
|---|---|
| X-SerpDad-Timestamp | The Unix time the call was signed |
| X-SerpDad-Signature | sha256= and the HMAC-SHA256 hex of the timestamp, a full stop and the raw body, keyed with your signing secret |
| X-SerpDad-Delivery | One ID per delivery, the same on every retry |
You set the signing secret when you add an outbound connection: at least 16 characters, stored encrypted and shown masked from then on.
On your side, rebuild the signature from the timestamp header and the raw body, compare it in constant time, and refuse calls with an old timestamp. That is all a receiver needs to know a call came from your SerpDad workspace.
Your URL and secret never appear in logs, emails or error messages.
Inbound. Start a workflow with a signed keyword list.
Give a workflow the Webhook trigger and publish it. SerpDad makes that workflow its own secret URL and signing secret. The secret is shown once. Rotate it and calls signed with the old one stop working at once, while the URL stays the same.
Your system posts JSON with a keywords list and, when the workflow targets more than one project, the project slug. The keywords go through the same import as a pasted list, and one run starts. The answer names the run number and how many keywords arrived.
A spending step after the trigger runs only inside a standing approval an Owner or Admin granted for that version, up to a per-run ceiling ($10.00 by default). A run above the ceiling waits and emails approvers.
| Rule | Limit |
|---|---|
| Calls per workflow | 60 an hour |
| Keywords per call | Up to 10,000 |
| Timestamp | Within five minutes of now |
| Replays | A signature already received is refused |
| Workflow | Must be active and published with a Webhook trigger |
What you need. An endpoint, a secret and a role.
- For outbound calls: a public https URL that answers with a 2xx, and a signing secret of at least 16 characters.
- For inbound calls: a system that can sign a JSON body with HMAC-SHA256 and send two headers.
- The Owner, Admin or Manager role in SerpDad to add connections and publish workflows. Standing approvals need an Owner or Admin.
Setup. Connect a webhook in three steps.
Add an outbound connection
In Workspace, Connections, choose Webhook, paste your https URL and set a signing secret.
Add the block
Put Call a webhook, or Create task with your webhook as the destination, after any step in a workflow, and publish the version.
Or add the trigger
For inbound calls, pick the Webhook trigger, publish, and copy the secret URL and the signing secret into your system. The secret is shown only once.
Triggers, blocks, standing approvals and every output: Jobs and workflows docs.
What it won't do. No unsigned calls, no plain http, no secrets in the body.
SerpDad never sends a webhook to an http address, never follows a redirect, and never puts your keys, keyword lists or article text in an outbound body.
Inbound, it refuses an unsigned call, a stale call and a replayed call before any work starts. A call cannot skip the money rules: spending still needs an approval or a standing approval with a ceiling.
No webhook can publish to a site. SerpDad never publishes for you.
Templates. Workflows that work well with webhooks.
Keyword pile to page plan
Swap the Manual trigger for a Webhook trigger, and your own intake form or warehouse can send keywords straight to the plan.
Keyword pile to WordPress drafts
Add Call a webhook at the end to tell your own system which drafts were staged.
Weekly AI visibility
Send the week's counts to your own dashboard when the checks finish.
Questions and answers.
Can't find the answer? Email us.
How are SerpDad webhook calls signed?
With HMAC-SHA256 and the signing secret you set on the connection. The signature covers the timestamp and the body, and arrives in the X-SerpDad-Signature header next to X-SerpDad-Timestamp. Check it before you trust the call.
What is in an outgoing webhook call?
The workflow, the run and its link, the project, and what reached the step as counts and up to 25 names. Never your keys, your keyword lists or article text.
How do I start a workflow from my own system?
Give the workflow a Webhook trigger and publish it. Your system then posts a signed JSON keyword list to the workflow's secret URL. Each call takes up to 10,000 keywords, and each workflow takes 60 calls an hour.
Can a webhook call spend money without anyone approving?
Only inside a standing approval an Owner or Admin granted for that published version, up to its per-run ceiling ($10.00 by default). A run above the ceiling waits and emails approvers.
What stops a captured call being sent again?
SerpDad refuses a call whose timestamp is more than five minutes old, and a call whose signature it has already received. Sign each call again with a new timestamp.
What if my endpoint is down?
Any answer other than a 2xx fails the step, so you can see it and retry it from the run. A retry carries the same X-SerpDad-Delivery value, so your endpoint can drop a repeat.
Signed in, signed out, approved in SerpDad.
Plan 1,000 keywords free, then wire it into your stack.
Your first plan is free up to 1,000 keywords, with briefs for the top 5 pages. No card needed.