Allow native Webhooks to authenticate via Connections

Allow native Webhooks to authenticate via Connections

Allow native Webhooks to authenticate via Connections (Basic Auth) instead of plaintext custom headers

Summary 
Please allow native Webhooks (Workflow Rules > Instant Actions > Webhooks) to authenticate against the destination endpoint using the existing Connections feature, with support for Basic Authentication. Today the only way to authenticate a webhook is to hardcode a secret (token, API key, signature) into a custom header or custom parameter, where it is stored and displayed in cleartext.

Current Behavior 
When configuring a webhook, the standard pattern to secure the receiving endpoint is to add a custom header such as:

    Authorization: Bearer <secret>
    X-Webhook-Token: <secret>

This works, but the secret value is stored and shown in plaintext everywhere the webhook configuration can be read.

Problem : The secret is exposed in several places : 
Because the value lives in the webhook config as clear text, it leaks through every surface that can read that config:

1. Sandbox / external developers: When a sandbox is shared with external developers (agencies, integrators, contractors), they can open the webhook configuration and read the authorization secret directly. A credential that is supposed to be private to the production integration is now visible to third parties.

2. Zoho CRM MCP server: Reading webhook configuration through the Zoho MCP server returns the custom header values verbatim. Any connected assistant or agent (or anyone with access to that MCP) can retrieve the secret. There is no way to mark the header as sensitive or to redact it.

3. General config read access: Anyone with permission to view the workflow rule can see the secret. There is no separation between "can edit the webhook" and "can read the credential."

In short: a value that is functionally a password is treated as plain configuration data, which makes it impossible to keep webhook authentication truly confidential.


Proposed solution : 
Let webhooks reference a Connection (Setup > Developer Space > Connections) for authentication, the same way custom functions already do with invokeurl ... connection:"...".

Specifically:
  1. Add an Authentication option to the webhook configuration that lets the user pick an existing Connection.
  2. Support Basic Authentication connections (username / password) as a connection type usable by webhooks.
  3. Inject the credential at runtime, server side, so the secret is never displayed in the webhook UI, never returned by the API or MCP, and never visible in a sandbox.
The credential would then be managed centrally as a Connection (rotatable, access controlled) instead of being duplicated in plaintext across webhook headers.

Benefits 
  1. No secret exposure in sandbox, API, or MCP responses.
  2. Centralized credential management: rotate the password in one Connection instead of editing every webhook.
  3. Least privilege: editing a webhook no longer means reading its credential.
  4. Consistency: webhooks would reuse the same secure auth mechanism that Deluge custom functions already rely on.

    • Recent Topics

    • Automatically set the default VAT percentage on a quote

      Every time I create a quote, I have to manually adjust the VAT and activate the checkbox for 21%. But all of our quotes include 21% VAT. So now occasionally, it happens that the checkbox is forgotten, and the customer receives an incorrect quote (without

    • Time Zone is incorrect

      Time zone is not working properly...I've checked it twice.  I'm eastern U.S. time it's currently 12:22 pm EST.  CRM shows 3:22 pm EST.

    • Send a converted Contact or Deal back to Leads using the Restore Lead extension for Zoho CRM

      Hello everyone, This comes up more than people expect: a Lead gets converted into a Contact, and sometimes a Deal along with it, because at the time it looked ready. Then the situation changes the opportunity turns out to be much further off than expected,

    • Zoho CRM mobile updates: Reports module, record tags, dynamic formula field, and more

      Hello everyone, We've made a few updates to the Zoho CRM mobile app to enhance your mobile CRM experience and efficiency. Here's a quick look at what's new: Reports module (iOS ) Record tags (iOS) Dynamic formula field (Android) WhatsApp business deep

    • Side scroll bar missing from "new editor"

      The "new editor" simply lacks a side scroll bar. Unable to navigate long notes without using the keyboard. Bad upgrade... (using web version)

    • Zoho Desk MCP doesn't expose all functions

      Hello, I'd like to be able to draft (rather than send) ticket replies using Claude Cowork. However, the Zoho Desk MCP doesn't currently offer that, despite it being available in the API (https://desk.zoho.com/DeskAPIDocument#Threads#Threads_DraftEmailReply).

    • Zoho Community Digest - July 2026 | Part 1

      Hello everyone! Keeping up with everything across the Zoho ecosystem is a lot, so we're bringing back the Zoho Community Digest, now weekly. Each week we round up the need-to-know announcements from the Zoho Community Forums, four editions a month, so

    • Canva Integration

      Hello! As many marketing departments are streamlining their teams, many have begun utilizing Canva for all design mockups and approvals prior to its integration into Marketing automation software. While Zoho Social has this integration already accomplished,

    • Feature Suggestion for Zoho Social: Auto-reply to Comments or Keywords

      Hi Zoho team, I'd like to suggest a very specific feature that would be extremely helpful for customer engagement: the ability to automatically send a reply to comments on posts — either all comments or those containing specific keywords. For example,

    • Format of data after export to spreadsheet

      Dear Zoho, can you explain to me what is the point of a report exporting to XLSX if the format of the amounts that will be created there is in text format and not suitable for anything? Why do I need data in a sheet with which nothing more can be do

    • Bring more clarity to your blueprints with color-coded transitions

      As your hiring processes evolve, blueprints naturally become more detailed. When multiple transitions connect different stages, it can take extra effort to identify approvals, rejections, reviews, and other actions at a glance. With this enhancement,

    • Zoho CRM gets a new email compose and lot more

      Dear Customers,  [UPDATE October 21, 2021: We have started opening these features to some of the customers already. And, it will be available to all the customers before November 2nd Week, 2021. Sorry for the delay caused]  [UPDATE February 21, 2022:

    • Create modules using natural language prompts

      Hello all, We’ve introduced a new enhancement to Zia that allows you to create custom and team modules in Zoho CRM using plain language prompts. Why this enhancement? Creating a custom module traditionally involves multiple steps—choosing field types,

    • Automatic Matching from Bank Statements / Feeds

      Is it possible to have transactions from a feed or bank statement automatically match when certain criteria are met? My use case, which is pretty broadly applicable, is e-commerce transactions for merchant services accounts (clearing accounts). In these

    • How emojis shape customer conversations

      World Emoji Day is celebrated on July 17. Did you know that this date was inspired by the 📅 calendar emoji, which shows July 17 on most platforms? What started as a detail in the emoji's design has turned into a global celebration of these tiny emoticons.

    • Custom Button Creation from Layout Editor in Zoho CRM

      Hello All, Buttons in Zoho CRM act as triggers that perform a specific action when clicked. Zoho CRM includes a set of system buttons that help you carry out common actions with a single click. Beyond these, your organization can create custom buttons

    • Displayed sample tracking for multi branch setup.

      We have multiple branches and one of the biggest challenges for us to be able to track if a particular item is in display or not. I am shooting in the dark but I am wondering if there is a solution for the following : Each product used for display is

    • Using IMAP configuration for shared email inboxes

      Our customer service team utilizes shared email boxes to allow multiple people to view and handle incoming customer requests. For example, the customer sends an email to info@xxxx.com and multiple people can view it and handle the request. How can I configure

    • Introducing Bulk Attachment Download from List View

      We're excited to introduce an update to attachment management in Zoho Recruit that lets you download attachments associated with selected records directly from the List View page of any module. How do I download attachments in bulk? You can now select

    • Advanced Group Settings: Customize and manage your email groups in Zoho Mail

      Email groups in your organization often require more than basic configurations to function effectively. With Zoho Mail's Advanced Group Settings, administrators can configure and manage policies, notifications, and more with greater precision. This gives

    • "code":3001 ["Failed to update data."]

      I would like to seek your expertise - I might be wrong on my approach also.. I highly appreciate your advice. 1 problem remains is when a new row was added on the existing one [from another form that trigger upon Successful form submission ], it gets

    • CRM gets location smart with the all new Map View: visualize records, locate records within any radius, and more

      Hello all, We've introduced a new way to work with location data in Zoho CRM: the Map View. Instead of scrolling through endless lists, your records now appear as pins on a map. Built on top of the all-new address field and powered by Mappls (MapMyIndia),

    • Workdrive on Android - Gallery Photo Backups

      Hello, Is there any way of backing up the photos on my android phone directly to a specific folder on Workdrive? Assuming i have the workdrive app installed on the phone in question. Emma

    • Auto sync Photo storage

      Hello I am new to Zoho Workdrive and was wondering if the is a way of automatically syncing photos on my Android phone to my workdrive as want to move away from Google? Thanks

    • List of Mail Merge Templates via Deluge

      Hello, Is it possible to get a list of the mail merge templates I've created in CRM within a custom function? I want to retrieve them and put them in a dropdown list but all I get is a scopes error! Can anyone see where I'm going wrong? Is this even possible?

    • Feature Request Improve parent-child relationship visibility

      Hi team, The Parent-Child ticket feature is great, but I've struggled to see the relationship between tickets when using ticket list views. It would be a great quality of life enhancement for users if child tickets were nested under parent tickets in

    • Displaying only unread tickets in ticket view

      Hello, I was wondering if someone might be able to help me with this one. We use filters to display our ticket list, typically using a saved filter which displays the tickets which are overdue or due today. What I'd really like is another filter that

    • Is there provision to charge the attendees to join the webinar?

      We want to host some webinar of public interest and want to charge them to participate in this. Does this feature in-build in the application? Offcourse, we will be having Razor pay account activated for these purpose.

    • Pricelists

      So we have them in books but I cannot find them in commerce?

    • Desktop app doesn't support notecards created on Android

      Hi, Does anybody have same problem? Some of last notecards created on Android app (v. 6.6) doesn't show in desktop app (v. 3.5.5). I see these note cards but whith they appear with exclamation mark in yellow triangle (see screenshot) and when I try to

    • Don't send customer email when creating a ticket

      Hi Is there an easy way to stop the system sending an email to the customer when we manually create ticket.

    • Connecting a contact with the deal + Emails not showing up under Deals

      Hello. I have two problems. Im not sure if the problem is due to level of my subscription - Im on Proffessional plan. 1. I have a JotForm connected with ZohoCRM which automatically creates a contact and a new deal based on form submission. That is done

    • How to add custom icons in Sites ?

      I've been trying to upload some of my own icons (specific to my business) to my zoho Site draft, and can't find a way to do it. I guess the workaround could be to insert images instead of icons and upload my icons as images, but I was wondering if its possible to customize the icon library.

    • Accessing GDPR Data Source metadata for workflows and Zoho Analytics

      Hi everyone, We have GDPR compliance enabled in Zoho CRM, which has added the Data Source section within the Data Privacy tab for Leads and Contacts. This section shows useful information such as: Original creation source, for example Zoho Forms Form

    • Tiktok

      When will Tiktok be added to the Zoho Social Platform?

    • Zoho Mail iOS app update: Spam Controls & Sender Verification

      Hello everyone! We are excited to introduce spam control enhancements in the Zoho Mail iOS app update. Let's dive into what's new. Spam Alerts in Mail Preview : Mail preview now shows warning alerts for emails identified as potentially harmful, helping

    • Mise à jour de Zoho Books – France

      Chers clients, Merci pour votre patience et votre soutien continu. Avec les évolutions réglementaires à venir en France nous introduisons de nouvelles fonctionnalités dans Zoho Books pour les clients français. Ces mises à jour ont été conçues pour répondre

    • Admin Logging in as another User

      How can a Super Admin login as another user. For example, I have a sales rep that is having issues with their Accounts and I want to view their Zoho Account with out having to do a GTM and sharing screens. Latest Update (27th April 2026): With the early

    • Zoho Books API: Bulk update thousands of records using Node.js with OAuth refresh, retries and resume support

      Hello everyone, During Zoho Books implementations, one common challenge is updating a large number of existing records. The current options are usually: Update records manually from the UI using Mass Update (with limited batch size). Update records one

    • SalesIQ's Summer '26 Release: For The Moments That Matter

      Every customer journey is made up of moments. The moment someone discovers your business. The moment they need help. The moment you decide to reach out. The moment a simple chat turns into something more. And the moments that continue long after the conversation

    • Next Page