Fondoo
GitHubStart your 7-day trial for $0Start trial
Docs

Connect Zapier to Fondoo

Live7 min readUpdated

Zapier connects thousands of apps with automated workflows called Zaps. This connection works the other way round from most Fondoo connections: you add Fondoo into Zapier with a Fondoo API key. Your Zaps can then publish sites, create checkout links, schedule social posts, send email and handle support tickets and contacts, and a Fondoo event (a new ticket, a paid order, a form submission) can start a Zap.

Fondoo provides a Zapier Platform CLI app (apps/zapier-app, MIT licensed). Fondoo has never pushed it to Zapier, so it is not in Zapier's app directory. You push it yourself as a private integration in your own Zapier developer account. Zapier's own validation has not been run on it yet, so treat it as early software.

What Fondoo can do with it

Triggers (all instant, using Fondoo webhooks; need webhooks:write and events:read): New Ticket (ticket.created), New Form Submission (form.submitted), Order Paid (order.paid), New Contact (contact.created), Social Post Published (post.published), Email Bounced (email.bounced) and Any Fondoo Event (pick any types from the list in Webhooks).

Actions (creates):

ActionFondoo operationAPI key scopes it needs
Publish Sitepublish_sitesites:write
Create or Update Productupsert_productpayments:write
Create Checkout Linkcreate_checkout_link (does not charge a card)payments:write
Schedule Social Postschedule_social_postssocial:write, analytics:write
Send Emailsend_emailemail:write
Create Support Ticket / Add Ticket Note / Update Ticketsupport_create_ticket / support_add_note / support_update_ticketsupport:write
Reply to Ticketsupport_replysupport:write, email:write
Create Newsletter Issuecreate_newsletter_issueemail:write, pages:write, sites:write, analytics:write
Create Contact / Update Contact / Tag Contactscreate_contact / update_contact / tag_contactscontacts:write

Searches: List Businesses (businesses:read), Find Site (sites:read), List Pages (pages:read), List Products (payments:read), List Tickets and Find Ticket (support:read), Find Contact and Search Contacts (contacts:read). List searches return one result that holds the whole list.

Every action has Idempotency Key (map something unique, such as the trigger's Fondoo event ID, so a Zapier retry cannot repeat the action), Dry Run (preview only) and Extra JSON (other documented fields for that operation).

Every action result includes fondooStatus:

  • completed: Fondoo did it.
  • dry_run: preview only. Nothing changed.
  • pending_approval: not done yet. The owner must approve in Fondoo.
  • connection_required: not done. Fondoo needs another connection first (for example Stripe for checkout links, or an email provider). The result includes a connectUrl.

Use a Zapier Filter so later steps run only when fondooStatus is completed.

What needs your approval: the same rules as for your agent. Money actions such as Create or Update Product, and sensitive support replies, wait for the owner. Complaints, refunds and legal tickets stay human-only.

Before you start

  • A Zapier account. Building a private integration is free; each person using it needs their own Zapier plan (private vs public).
  • Node.js and npm on your computer, plus pnpm to build the app from the Fondoo source.
  • The Fondoo source code containing apps/zapier-app.
  • Your Fondoo API base URL. Hosted Fondoo: https://api.getfondoo.com (no /v1). It must be HTTPS and reachable from the internet, because Zapier runs in its own cloud. localhost and plain HTTP will not work.

Step by step: get your credentials

1. Push the app to your Zapier account

Follow Zapier's CLI tutorial for the current details.

  1. Install the CLI: npm install -g zapier-platform-cli.
  2. Log in: zapier login. Zapier saves a deploy key in ~/.zapierrc.
  3. In the Fondoo source, run pnpm install. In apps/zapier-app, add zapier-platform-core at the version in src/version.ts (currently 19.2.1), for example pnpm add [email protected].
  4. Build and check: pnpm --filter @fondoo/zapier-app build. Optionally run Zapier's own validation (zapier validate).
  5. Register the app once: zapier-platform register (the older zapier register still works but is deprecated). Give it a name such as "Fondoo".
  6. Push it: zapier-platform push (older form: zapier push).

All integrations start private and do not appear in Zapier's app directory.

2. Share it (optional)

In Zapier's developer platform, open My Integrations, pick your integration, then Manage → Sharing (sharing docs). You can invite people by email (per version, and revocable) or copy a public invite link. An invite link cannot be revoked once shared, and you cannot see who used it. Zapier caps email invites; its pages state 100 and 200 users in different places.

3. Create a scoped Fondoo API key

Give the key only the scopes of the triggers and actions you use, from the tables above. Always include events:read (the connection test uses it). Keys can never get owner or admin access. Fondoo shows the key once. See Connect it in Fondoo.

4. Connect your account in Zapier

  1. In a Zap, choose the Fondoo app and click to connect a new account.
  2. Fondoo API Base URL: your HTTPS base URL, without /v1.
  3. API Key: the fondoo_... key.
  4. Zapier tests the connection with the read-only list_event_types. The account is labeled with your API host.

The key is sent only to requests aimed at that base URL.

Connect it in Fondoo

Zapier is not a Fondoo connector. You won't find it under Connections, and connect_service({provider:"zapier"}) does not work. On the Fondoo side you only create an API key.

(a) In the dashboard: open Settings → API keys → Create key. The form currently offers only one read level at a time (Read analytics, Read sites or Read pages). That is not enough for Zapier, because the connection test needs events:read. Use (b) or (c) until the form offers more. This may differ for your account.

(b) By asking your agent:

Create a Fondoo API key called "Zapier" with the scopes events:read, webhooks:write, support:read and support:write.

create_api_key({ name: "Zapier", scopes: ["events:read", "webhooks:write", "support:read", "support:write"] })

For an agent this always returns pending_approval with an approval link. An agent can only grant scopes it holds itself. Only a signed-in human owner can approve, never through MCP. The key appears once in the approval result, so the agent never sees it. Note: approving from the Needs your OK card on the Home page currently shows only "Approved." and not the key. If that happens, revoke the key and use the approval link or option (c). This may differ for your account.

(c) Over REST with an owner key (for example a self-hosted bootstrap owner key). It returns id, key and scopes at once:

POST https://api.getfondoo.com/v1/ops/create_api_key
Authorization: Bearer <owner key>
Content-Type: application/json

{"name":"Zapier","scopes":["events:read","webhooks:write","support:read","support:write"]}

Workspaces that enforce owner two-factor authentication reject owner keys. Manage keys with list_api_keys (names, scopes, last use) and revoke_api_key({keyId}) (agents need approval), or Settings → API keys → Revoke.

Webhooks

The triggers are Zapier REST hooks (Zapier REST hook triggers). You do not create webhooks by hand.

  • When you turn a Zap on, the app calls POST /v1/webhooks (subscribe_webhook) with Zapier's target URL, the event type(s) and an optional Site ID. Zapier stores the returned webhook ID and signing secret.
  • When you turn it off or delete it, the app calls DELETE /v1/webhooks/{id} (unsubscribe_webhook). "Not found" counts as already removed.
  • In the Zap editor, sample data comes from your three most recent matching events (list_events).
  • Every delivery is checked. Fondoo sends Fondoo-Signature: t=<unix seconds>,v1=<hex>, where hex is HMAC-SHA256 of <t>.<raw body> with the secret. The app compares in constant time with a 300-second tolerance and halts invalid deliveries. The output field Signature Check shows verified. If Zapier does not pass the raw request to the app, it shows not_checked and the event is not verified. Whether Zapier passes it was not confirmed in a live run. If you see not_checked, treat the event as a notification and re-read the record with a Find search before acting.

Each event is flattened into fields: id, type, version, workspaceId, siteId, createdAt, resourceId, action and state_* fields.

Event types for Any Fondoo Event: ticket.created, ticket.updated, ticket.solved, complaint.opened, refund.requested, csat.received, site.published, page.published, page.updated, deploy.rolled_back, form.submitted, contact.created, contact.updated, contact.deleted, signup.recorded, order.paid, subscription.started, subscription.updated, subscription.canceled, payment.failed, refund.recorded, dispute.opened, email.sent, email.delivered, email.bounced, email.complained, email.opened, email.clicked, email.unsubscribed, post.scheduled, post.published, post.failed, seo.issue.found, seo.issue.resolved, index.status.changed, ranking.changed, alert.raised, approval.requested, approval.decided, usage.threshold.reached, domain.registered, purchase.completed, release.ingested, content.page.generated, operation.completed, asset.uploaded, asset.deleted, webhook.test, entitlement.updated, order.created.

Your agent can also use list_webhooks, list_webhook_deliveries({webhookId}), replay_webhook_delivery({deliveryId}) and send_test_event({webhookId}). Do not use rotate_webhook_secret on a Zap's webhook: Zapier keeps the old secret and later deliveries would fail the check. Turn the Zap off and on instead.

Test that it works

  1. Connect your Fondoo account in Zapier. The test should pass.
  2. Add the Find Site search with a site ID. You should get the site.
  3. Run an action with Dry Run set to true. Expect fondooStatus: dry_run.
  4. Make a Zap with Any Fondoo Event and type webhook.test. Turn it on, then ask your agent to run list_webhooks and send_test_event({webhookId}). Check the Zap history for a run with Signature Check verified.

Troubleshooting

  • "Fondoo base URL must use https". Use the HTTPS base URL without /v1.
  • Connection test fails with UNAUTHORIZED. The key is wrong or revoked. Paste it again.
  • FORBIDDEN / "Missing required scope". The key lacks a scope for that step. Create a new key with the right scopes and reconnect.
  • The Zap won't turn on. Turning it on creates a Fondoo webhook, which needs webhooks:write. Check the key's scopes with list_api_keys.
  • Runs show "Fondoo signature missing or invalid; delivery ignored". The secret no longer matches, for example after a rotation. Turn the Zap off and on again.
  • fondooStatus is pending_approval or connection_required. Nothing happened. Approve the request, or connect the missing provider, then re-run.

Limits, data and security

  • Rate limits: the Fondoo API allows by default 120 requests per minute per key and 600 per minute per IP, and returns 429 when exceeded. Hosted limits may differ. Zapier also limits calls for private integrations based on the owner's Zapier plan (private vs public).
  • Webhook delivery: 10-second timeout, no redirects, retries with growing delays (up to 6 hours apart). Fondoo disables a webhook after three days of failures. Deliveries may count toward your plan's event usage.
  • What is stored where: your API key is stored in Zapier's connected account. Fondoo keeps only a hash of it. The webhook secret is encrypted in Fondoo and stored by Zapier with the subscription.
  • Rotate: create a new key, reconnect the account in Zapier, then revoke the old key. Disconnect: turn off the Zaps (this deletes their subscriptions) and revoke the key.