Connecting Fortis Webhooks to Zapier

This guide helps you set up Fortis webhook reception via Zapier in 30–40 minutes. As a result, you will receive email notifications about events, while Zapier verifies each event's authenticity using digital signatures.

For the full technical reference, see: Fortis API Documentation

How It Works

Fortis sends an HTTP request with event data to a special URL generated by Zapier. Zapier (as a Zap) receives the request, verifies the signature, filters out forgeries, and sends you an email. We will build a Zap with four steps:

1. Receive request (Catch Raw Hook).
2. Verify signature (Python code).
3. Filter (only genuine events pass through).
4. Send email (Email by Zapier).

Prerequisites

• A working email address to register on Zapier.
• Access to Fortis merchant portal (test environment) with Owner or Administrator role.
• Company tariff must be General Full or F&B Full (others do not support webhooks).
• A notepad or password manager – you will see a secret key only once, so save it.

Part 1. Register on Zapier

1. Go to zapier.com and click Sign up.
2. Sign in via Google or use email and password.
3. Skip the onboarding questions (click Skip).
4. Make sure you are on a free trial – it gives access to premium features (including Webhooks and Code by Zapier).

Part 2. Create a Zap and Get Your URL

1. Click + Create → Zaps.
2. In the Trigger block, select the app Webhooks by Zapier (orange icon with a lightning bolt).
3. In Trigger event, choose Catch Raw Hook and click Continue. Important: choose Raw so we get the raw body and headers.
4. Copy the generated URL (e.g., https://hooks.zapier.com/hooks/catch/1234567/abcdef/) and save it.
5. Click Continue, then Test trigger – Zapier will start listening for the first request. Until it arrives, you will see "We couldn't find a request" – this is normal.

Part 3. Configure Endpoint in Fortis merchant portal

1. Log in to Fortis merchant portal → Settings → Developer tools → Webhooks.
2. Create a new Endpoint and specify:
   • URL – the copied address from Zapier.
   • Select the desired event types.
3. After saving, copy the secret key – it is shown only once. Save it in your notepad.
4. Click "Test" – Fortis will send a test event to your Zapier URL.

Verification status Fortis may show that the endpoint verification failed – this is expected for Zapier (Zapier does not respond with the required echo). This does not affect event delivery.

Part 4. Capture the First Event in Zapier

1. Go back to Zapier, click Test trigger again (or Find new records).
2. The "Raw Hook A" record will appear – this is your test event.
3. Expand it – you will see the following fields:
   • raw body – JSON event data.
   • headers – including X-Fortis-Signature, X-Fortis-Timestamp, X-Fortis-Event-Type.
4. Select this record and click Continue with selected record.

Part 5. Signature Verification (Code Step)

Now add logic to verify the signature.

1. Below the trigger, click + → Code by Zapier → choose event Run Python.
2. In Input Data, create four variables:

3. In the Code field, paste the following script (copy exactly):

import hashlib, hmac, time

raw_body = input_data['raw_body']
signature = input_data.get('signature', '')
timestamp = input_data.get('timestamp', '')
secret = input_data['secret']

payload = (timestamp + '.' + raw_body).encode('utf-8')
expected = 'sha256=' + hmac.new(
    secret.encode('utf-8'),
    payload,
    hashlib.sha256
).hexdigest()

valid = hmac.compare_digest(expected, signature)
fresh = timestamp.isdigit() and abs(time.time() - int(timestamp)) < 300

output = {
    'signature_valid': valid,
    'fresh': fresh,
    'accepted': valid and fresh
}

4. Click Continue, then Test step. The result should show signature_valid: true, fresh: true, accepted: true.
   • If accepted: false – check your secret (no extra spaces, correct key).
   • If fresh: false – the event is too old (older than 5 minutes), send a new test from Fortis.

Part 6. Filter – Only Genuine Events Pass

1. Click + below the code step and select Filter by Zapier.
2. Set the condition:
   • Field: Accepted (from previous step, step 2)
   • Condition: Is true
3. Click Continue. Now all events with invalid signatures will stop at this filter.

Part 7. Send Email and Turn On the Zap

1. Click + → Email by Zapier → event Send Outbound Email.
2. Fill in the fields:
   • To – your email address.
   • Subject – e.g., "Fortis webhook: event received".
   • Body – insert Raw Body from step 1 (so you see the event content).
3. Click Continue, then Test step – a test email will arrive.
4. Click Publish in the top-right corner. The Zap becomes active and will process all future events.

Part 8. Final Verification

Positive Scenario (genuine event)

• Send a test from Fortis or perform a real action – in Zap History you will see a successful run, all steps green.
• The email will arrive.
• In Fortis delivery history, this delivery will be marked as successful.

Negative Scenario (forgery)

• Temporarily replace the secret in the Code step with any other string and publish the Zap.
• Send a test from Fortis – in Zap History the run will stop at the filter (status Filtered), no email.
• Restore the correct secret and republish the Zap.

Troubleshooting

Note: There is no separate development or QA portal — all webhook configuration and event testing are done directly in the production environment. Please treat every setup step as a live change: keep the initial scope minimal, use a dedicated test object or a small controlled transaction to validate the flow