---
title: "Connect Calendly webhooks to Shopify Flow - Workflow Webhooks"
description: "Send Calendly webhooks into Shopify Flow. Step-by-step setup with Calendly's HMAC signature verified on every request, plus what the app checks and how to troubleshoot."
canonical: "https://docs.workflow-webhooks.app/how-to-connect-calendly"
---

# How to connect Calendly to Shopify Flow

Calendly sends a webhook when a meeting is booked or cancelled through one of your event types. **Workflow Webhooks** turns that call into a **Shopify Flow trigger**, so your store can react to it: tag a customer, add an order note, send an internal email, update a metafield - anything Shopify Flow can do.

This guide sets up the whole path - Calendly sends, Workflow Webhooks receives and verifies, Shopify Flow acts - with Calendly's HMAC signature checked on every request, so nothing but Calendly can start your workflow.

## What you can build

- Tag a customer who booked a styling or consultation call, so you can segment them later.
- Add a customer note with the meeting time before the call happens.
- Email the assigned staff member with the customer's Shopify order history when the booking comes in.

Typical events to send: `invitee.created` (booked), `invitee.canceled`.

## Before you begin

- **Workflow Webhooks** installed on your Shopify store.
- **Shopify Flow** installed, which is free from the Shopify App Store.
- An account on Calendly with permission to create webhooks.

## Step 1 - Create the webhook in Workflow Webhooks

1. Open **Workflow Webhooks -> Webhooks -> Create webhook** and give it a name you will recognise in Flow, such as `Calendly events`.
2. Under **Authentication**, choose **HMAC**.
3. Under **Signature provider**, pick **Calendly**. The app fills in the header, algorithm, signed payload and replay window for you - there is nothing else to configure.
4. Leave the secret empty for now and **Save**. Copy the webhook URL shown on the page.

See [Authentication](https://docs.workflow-webhooks.app/authentication.md) for the other authentication modes, and [Payload mapping and Flow variables](https://docs.workflow-webhooks.app/payload-mapping.md) for choosing which fields reach Flow.

## Step 2 - Add the endpoint in Calendly

Create the webhook subscription through the Calendly API or the developer portal with the URL you copied. The signing key is returned once, when the subscription is created.

### How to find your Calendly signing secret

The signing key returned when you created the webhook subscription.

[Calendly's own documentation on webhook signatures](https://developer.calendly.com/api-docs/ZG9jOjM2MzE2MDA3-webhook-signatures) has the exact wording and screenshots for your account.

Paste that secret into the webhook's **Secret** field in Workflow Webhooks and save. From that moment every Calendly delivery is verified before it reaches Flow.

## What this checks

| What | Value |
| --- | --- |
| **Signature header** | `Calendly-Webhook-Signature` |
| **Where the signature sits** | In the `v1` value of that header, which carries `key=value` pairs separated by commas |
| **What is signed** | `{timestamp}.{body}` |
| **Signature** | HMAC-SHA256, hex encoded |
| **Timestamp** | The `t` value of the signature header, as Unix seconds |
| **Replay protection** | Requests whose signed timestamp is more than 6 minutes away from now are rejected |
| **The secret** | Used as plain text. Paste it exactly as the sender shows it |

In the signed payload, `{body}` is the raw request body, byte for byte, and `{timestamp}` is the timestamp above.

A request that fails any of these is rejected with `401`, is recorded in [History and troubleshooting](https://docs.workflow-webhooks.app/history-and-troubleshooting.md), and never starts a workflow.

## Step 3 - Build the Shopify Flow workflow

1. In **Shopify Flow**, create a workflow and choose the **Workflow Webhooks** trigger.
2. Press **Record events**, then send a test event from Calendly (or use **Send test** in Workflow Webhooks) so Flow learns the shape of your data.
3. Every webhook you own fires the same Flow trigger, so add a first condition on the **webhook id** to keep this workflow to Calendly only. The id is shown on the webhook page.
4. Add your actions - tag a customer, add a note, send an internal email, update a metafield.

## Step 4 - Test it end to end

Trigger a real event in Calendly. In **Workflow Webhooks -> History** you should see the invocation with status **Success**. If the signature was wrong you get a failed entry with the reason instead, and [Verifying signed webhooks](https://docs.workflow-webhooks.app/signature-verification.md) explains the signature tester that shows you exactly which step failed.

### The signature does not match

In this order: the **secret** (the most common cause - an extra space, or a key from the wrong environment), whether the sender is using a **different endpoint's** secret, and whether anything between Calendly and the app **rewrites the body**. Signatures cover the raw bytes, so a proxy that re-formats JSON breaks them. The signature tester on the webhook page shows the exact text that was signed.

### I get 401 on every request

Check that the webhook's authentication is set to **HMAC** with the **Calendly** provider selected, that the secret is filled in, and that Calendly is posting to the URL exactly as the app shows it, including the code at the end.

### Nothing appears in History

The request never arrived. Re-check the URL in Calendly, and look at Calendly's own delivery log for the response it got. A `404` means a wrong or deleted webhook, a `429` means you are over your plan's invocation limit - see [Plans and usage](https://docs.workflow-webhooks.app/plans-and-usage.md).

### The workflow runs for the wrong events

Every webhook in your store fires the same Flow trigger. Add a condition on the **webhook id** as the first step of the workflow, or narrow the events you send from Calendly.

### Requests fail with "timestamp outside tolerance"

Calendly signs a timestamp and the app rejects anything more than 6 minutes old. This is normally a clock problem on the sending side, or a delivery that Calendly retried much later with the original timestamp. Retries from the same original request cannot pass; ask Calendly to send a fresh event.

## Related

- [Verifying signed webhooks](https://docs.workflow-webhooks.app/signature-verification.md) - every provider we verify, and how to describe one we do not.
- [Payload mapping and Flow variables](https://docs.workflow-webhooks.app/payload-mapping.md) - getting the right fields out of the payload and into Flow.
- [Duplicate delivery protection](https://docs.workflow-webhooks.app/duplicate-delivery.md) - what happens when Calendly retries a delivery.
- [History and troubleshooting](https://docs.workflow-webhooks.app/history-and-troubleshooting.md) - the log of every request, with replay.