Zapier & Webhook Automations

Zapier provides a no-code way to connect Attro with thousands of other apps.

Set Up the Connection

1. Go to Settings → Integrations → Zapier
2. Click "Connect to Zapier"
3. You'll be redirected to Zapier
4. Sign in or create a Zapier account
5. Authorize Attro to access your account
6. Return to Attro - connection confirmed

Create Your First Zap

1. In Zapier, click "Create Zap"
2. Search for "Attro" as the trigger app
3. Select your trigger event (e.g., "New Affiliate")
4. Connect your Attro account
5. Test the trigger
6. Add your action app (Slack, Google Sheets, etc.)
7. Configure the action
8. Turn on your Zap

Available Triggers

| Trigger              | Fires When                       |
|----------------------|----------------------------------|
| New Affiliate        | Affiliate signs up or is created |
| Affiliate Approved   | Status changes to active         |
| New Conversion       | Conversion is recorded           |
| Conversion Approved  | Conversion status → approved     |
| Conversion Rejected  | Conversion status → rejected     |
| Payout Sent          | Payout is processed              |
| High Fraud Score     | Fraud score exceeds threshold    |

Here are proven automation recipes to get you started.

Slack: New Affiliate Notification

Trigger: Attro - New Affiliate
Action: Slack - Send Channel Message

Message Template:
🎉 New affiliate signed up!
Name: {{affiliate_name}}
Email: {{affiliate_email}}
Type: {{affiliate_type}}
Website: {{affiliate_website}}

Google Sheets: Conversion Log

Trigger: Attro - Conversion Approved
Action: Google Sheets - Create Spreadsheet Row

Columns:
| Date | Affiliate | Amount | Commission | Customer Email |
|------|-----------|--------|------------|----------------|
| {{created_at}} | {{affiliate_name}} | {{amount}} | {{commission}} | {{customer_email}} |

Gmail: High-Value Conversion Alert

Trigger: Attro - New Conversion
Filter: Amount > 500
Action: Gmail - Send Email

To: [email protected]
Subject: High-value conversion! ${{amount}}
Body:
A high-value conversion just came in!

Amount: ${{amount}}
Affiliate: {{affiliate_name}}
Customer: {{customer_email}}

Review in Attro: [link]

HubSpot: CRM Contact

Trigger: Attro - New Affiliate
Action: HubSpot - Create Contact

Fields:
Email: {{affiliate_email}}
First Name: {{affiliate_first_name}}
Company: {{affiliate_company}}
Lead Source: Affiliate Program
Custom Field (Affiliate ID): {{affiliate_id}}

For direct integration with your systems, configure custom webhooks that receive events from Attro.

Add Webhook Endpoint

1. Go to Settings → Webhooks
2. Click "Add Endpoint"
3. Enter your webhook URL
4. Select events to receive
5. Set a secret for signature verification
6. Save

Webhook Configuration

URL: https://yourapi.com/webhooks/attro
Secret: whsec_your_random_secret_here

Events:
☑ affiliate.created
☑ affiliate.approved
☑ conversion.created
☑ conversion.approved
☐ conversion.rejected
☑ payout.completed

Available Events

| Event                  | Description                      |
|------------------------|----------------------------------|
| affiliate.created      | New affiliate registered         |
| affiliate.approved     | Affiliate status → active        |
| affiliate.suspended    | Affiliate suspended              |
| conversion.created     | New conversion recorded          |
| conversion.approved    | Conversion approved              |
| conversion.rejected    | Conversion rejected              |
| payout.initiated       | Payout processing started        |
| payout.completed       | Payout successfully sent         |
| payout.failed          | Payout failed                    |
| fraud.detected         | High fraud score conversion      |

Understanding the payload structure helps you build reliable integrations.

Common Payload Structure

{
  "event": "conversion.created",
  "timestamp": "2026-01-26T12:00:00Z",
  "data": {
    "id": "conv_abc123",
    "affiliate_id": "aff_xyz789",
    "affiliate_name": "John Smith",
    "offer_id": "off_def456",
    "offer_name": "Pro Plan",
    "amount": 99.00,
    "currency": "USD",
    "commission_amount": 19.80,
    "status": "pending",
    "customer_email": "[email protected]",
    "metadata": {
      "plan": "pro",
      "period": "monthly"
    },
    "created_at": "2026-01-26T12:00:00Z"
  }
}

Affiliate Events

{
  "event": "affiliate.created",
  "timestamp": "2026-01-26T10:30:00Z",
  "data": {
    "id": "aff_abc123",
    "display_name": "Jane Doe",
    "company_name": "Acme Corp",
    "email": "[email protected]",
    "type": "external",
    "status": "pending",
    "website": "https://acme.com",
    "created_at": "2026-01-26T10:30:00Z"
  }
}

Payout Events

{
  "event": "payout.completed",
  "timestamp": "2026-01-26T15:00:00Z",
  "data": {
    "id": "pay_abc123",
    "affiliate_id": "aff_xyz789",
    "affiliate_name": "John Smith",
    "amount": 523.40,
    "currency": "USD",
    "method": "paypal",
    "status": "completed",
    "transaction_id": "PAY-xxx",
    "created_at": "2026-01-26T14:55:00Z",
    "completed_at": "2026-01-26T15:00:00Z"
  }
}

Always verify webhook signatures to ensure events are legitimately from Attro.

How Signatures Work

1. Attro computes HMAC-SHA256 of the payload using your secret
2. Signature is included in the X-Attro-Signature header
3. Your server recomputes the signature and compares

Node.js Verification

const crypto = require('crypto');

function verifyWebhookSignature(payload, signature, secret) {
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(payload, 'utf8')
    .digest('hex');

  const expected = `sha256=${expectedSignature}`;

  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

// Express middleware
app.post('/webhooks/attro', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-attro-signature'];
  const payload = req.body.toString();

  if (!verifyWebhookSignature(payload, signature, WEBHOOK_SECRET)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  const event = JSON.parse(payload);

  // Handle the event
  switch (event.event) {
    case 'conversion.created':
      handleNewConversion(event.data);
      break;
    case 'affiliate.created':
      handleNewAffiliate(event.data);
      break;
  }

  res.status(200).json({ received: true });
});

Python Verification

import hmac
import hashlib

def verify_webhook_signature(payload: bytes, signature: str, secret: str) -> bool:
    expected = hmac.new(
        secret.encode('utf-8'),
        payload,
        hashlib.sha256
    ).hexdigest()

    expected_sig = f"sha256={expected}"

    return hmac.compare_digest(signature, expected_sig)

# Flask example
@app.route('/webhooks/attro', methods=['POST'])
def handle_webhook():
    signature = request.headers.get('X-Attro-Signature')
    payload = request.get_data()

    if not verify_webhook_signature(payload, signature, WEBHOOK_SECRET):
        return jsonify({'error': 'Invalid signature'}), 401

    event = request.get_json()

    # Handle the event
    if event['event'] == 'conversion.created':
        handle_new_conversion(event['data'])

    return jsonify({'received': True}), 200

Security: Always use timing-safe comparison functions to prevent timing attacks when verifying signatures.

Attro automatically retries failed webhook deliveries with exponential backoff.

Retry Schedule

| Attempt | Delay After Previous |
|---------|---------------------|
| 1       | Immediate           |
| 2       | 1 minute            |
| 3       | 5 minutes           |
| 4       | 30 minutes          |
| 5       | (webhook disabled)  |

Success Criteria

A webhook delivery is successful if your endpoint returns:

• HTTP status 200-299
• Within 30 seconds

Handle Failures Gracefully

// Good: Return 200 quickly, process async
app.post('/webhooks/attro', (req, res) => {
  // Immediately acknowledge
  res.status(200).json({ received: true });

  // Process in background
  processWebhookAsync(req.body).catch(console.error);
});

// Bad: Process synchronously (may timeout)
app.post('/webhooks/attro', async (req, res) => {
  await doSlowDatabaseOperation(req.body); // Might take > 30s
  await sendSlackNotification(req.body);
  res.status(200).json({ received: true });
});

Idempotency

Webhooks may be delivered multiple times. Use the event ID for idempotency:

// Track processed events
const processedEvents = new Set(); // Use Redis in production

app.post('/webhooks/attro', (req, res) => {
  const event = req.body;

  // Check if already processed
  if (processedEvents.has(event.data.id)) {
    return res.status(200).json({ received: true, duplicate: true });
  }

  // Mark as processing
  processedEvents.add(event.data.id);

  // Handle event...

  res.status(200).json({ received: true });
});

Monitor Webhook Health

Check webhook status at Settings → Webhooks. You'll see:

• Recent delivery attempts
• Success/failure status
• Response codes and bodies
• Average response time