Make and Zapier integration

Make and Zapier connect Perkamo to the rest of your operations without code. The integration has two directions, and both work today:

• Out of Perkamo: webhooks trigger your scenarios when something happens in

the program (a perk unlocks, a level is reached, a reward is redeemed).

• Into Perkamo: scenarios send trusted events or identify calls back, for

example after an approved offline action or a manual review.

Trigger scenarios from Perkamo webhooks

1. In Make, add a Custom webhook trigger (in Zapier, Webhooks by Zapier

with _Catch Hook_) and copy the generated URL.

1. In the Perkamo console, open Webhooks, add an endpoint with that URL and

select the event types the scenario should receive.

1. Send a test delivery from the endpoint's actions and map the payload fields

in your scenario.

Perkamo signs every delivery. No-code catch hooks cannot verify signatures, so treat the incoming data as a notification: fine for alerts, CRM notes or routing to an operator. Before performing anything sensitive, read back the authoritative state with a signed API call (for example GET /v1/customer/:userId).

Good first automations:

• Notify the team channel when a VIP perk unlocks.
• Create a helpdesk task when webhook deliveries start failing.
• Add unlocked perks to the customer record in your CRM.

Send events into Perkamo

Perkamo mutation endpoints require a signed request, which keeps spoofed requests out of your points economy. Both platforms can produce the signature.

The signature over a JSON body works the same everywhere:

1. bodyHash = sha256hex(body)
2. base = "v1.<unixSeconds>.POST.<path>.<bodyHash>"
3. signature = "v1=" + hmacSha256Hex(base, serverKey)
4. Send headers x-perkamo-api-key, x-perkamo-timestamp,

x-perkamo-signature.

Make

Make has sha256 and HMAC support built in. In a scenario:

1. Set variables: timestamp = {{floor(timestamp / 1000)}} and body =

the JSON string for POST /v1/events.

1. Set variable signature =

v1={{sha256(concat("v1."; timestamp; ".POST./v1/events."; sha256(body)); "hex"; serverKey)}} (the third argument turns the hash into an HMAC with your key).

1. HTTP module: POST https://api.perkamo.com/v1/events with the three

x-perkamo-* headers and the same body string.

Zapier

Use a Code by Zapier step (JavaScript) before the request:

const crypto = require("crypto");

const body = JSON.stringify({
  user_id: inputData.userId,
  event: inputData.event,
  transaction_id: inputData.transactionId,
});
const timestamp = String(Math.floor(Date.now() / 1000));
const bodyHash = crypto.createHash("sha256").update(body).digest("hex");
const base = ["v1", timestamp, "POST", "/v1/events", bodyHash].join(".");
const signature =
  "v1=" + crypto.createHmac("sha256", inputData.serverKey).update(base).digest("hex");

output = { body, timestamp, signature };

Then a Webhooks by Zapier POST to https://api.perkamo.com/v1/events with the code step's outputs in the headers and body. Store the server key in the code step's input fields, not in the URL.

Idempotency

Scenario runs repeat: retries, replays and manual re-runs are normal in automation platforms. Always derive transaction_id from the source record (an order id, a ticket id), never from the current time, so a repeated run is recognized as a duplicate instead of awarding points twice. See Concepts.

Keep authority in your backend

Automation platforms are great for operations glue and bad at being the source of truth. Checkout, billing and reward fulfillment that moves real money should stay in a trusted backend service. If a scenario grows into core program logic, move it behind your backend and call the SDKs instead.