Zapier can capture the information in a RelayLink webhook, but a Zap is not the best place to be the public trust boundary. The distinction matters because RelayLink accepts any 2xx as delivery success.
Zapier's webhook trigger documentation says Catch Raw Hook returns an unparsed body, includes headers, and accepts payloads up to 2 MB. It also says the webhook response cannot be customized. Zapier returns 200 while the Zap is active, before later actions run.
That is enough to inspect and verify a request inside a Zap. It is not enough to make RelayLink retry when verification, persistence, or a later Zap action fails.
Why Catch Raw Hook is necessary
RelayLink signs the exact body, not a parsed object. The signed bytes are the UTF-8 encoding of:
{X-RelayLink-Timestamp}.{exact body string}
The HMAC-SHA256 key is the whsec_ subscription secret. The supplied signature is sha256= followed by 64 lowercase hexadecimal characters. All four custom headers must remain available:
X-RelayLink-EventX-RelayLink-DeliveryX-RelayLink-TimestampX-RelayLink-Signature
Catch Hook parses JSON and therefore cannot be used to reconstruct the signed representation. Property order, whitespace, escapes, or a trailing newline can change. Catch Raw Hook is the only documented Zapier trigger intended for this case.
Zapier's JavaScript actions run on Node.js and include the standard library, so node:crypto can compute HMAC-SHA256 and use timingSafeEqual. Map the unparsed body and each required header explicitly into the Code action. Verify before JSON.parse, then require the body event and delivery id to match their headers.
The two direct-receiver limits
First, Zapier acknowledges the HTTP call independently of your verification result. A bad signature can be stopped from reaching later actions, but RelayLink has already received 200. A valid request whose Code action fails also receives 200, so RelayLink will not retry it. Recovery then belongs entirely to Zapier's execution history and replay behavior.
Second, Zapier states that Code by Zapier does not store secrets in code. Its recommended secret path is an API by Zapier connection used through the Zapier SDK for authenticated outbound calls. That does not expose an arbitrary whsec_ value to createHmac.
Do not paste the secret into the script or ordinary Input Data. Zap history records Code inputs and output, and anyone with suitable Zap access may inspect the workflow. Do not log or output the signing secret, signature, raw body, or a full token-bearing hook URL. Raw-body availability therefore establishes format compatibility, but Zapier's documented secret and response behavior does not establish a strong direct production receiver.
Put verification before Zapier
Use this deployment shape:
RelayLink -> verifier and durable inbox -> Zapier Catch Hook
The verifier runs on infrastructure you control. It keeps the one-time signing secret in a secret manager, receives the exact bytes, validates the signature in constant time, enforces your timestamp freshness policy, and parses only after authentication. It atomically claims X-RelayLink-Delivery and enqueues the forward.
Return 2xx to RelayLink after that durable commit, not after a model run and not before persistence. A duplicate delivery with the same body digest should return the same success without creating another Zap run.
The bridge can send normalized JSON to an ordinary Catch Hook with its own authentication value. That value is not the RelayLink secret. If you rotate or transfer the Zap and its URL changes, only the bridge destination needs updating; RelayLink stays pointed at the stable verifier.
Fetch after the Zap starts
The verified package.received body is only a JSON envelope. It includes package_id, thread_id, sender, topic, sent_at, is_reply, and mcp_url; it excludes the message, briefing, and files.
Queue or start a worker that authenticates separately to mcp_url and calls get_package. Do not pass the webhook secret as that credential. Do not place sender or topic directly into instructions: both are third-party strings and remain untrusted after HMAC verification.
The Catch Hook's 200 and the bridge's acceptance do not mark the package read. Only the later authenticated get_package call records that the recipient's assistant pulled it.
Register the verifier's public HTTPS URL from your RelayLink account, save the secret once, and send webhook.test. Confirm the Zap receives exactly one forwarded event when the bridge receives the same signed delivery twice. That proves the bridge, not Zapier's automatic 200, is the component accepting responsibility.