Catch-hook tools receive the request but do not verify the HMAC signature on their own. Add a code step that does, using the
snippets on the signature page, and stop the workflow when it returns false. The code step needs the raw request
body and the X-RankPilot-Signature header.
- Zapier: trigger "Catch Raw Hook" (not "Catch Hook", which parses the body first), then a "Code by Zapier" step.
- Make: a custom webhook with "Get request headers" on and the body kept as text, then a code module.
- n8n: a Webhook node with "Raw Body" on, then a Code node.