Webhook Endpoint

A webhook trigger fires when an outside service (GitHub, Stripe, a CI system, your own script) sends an HTTP request to Scape. For that to work, the service needs a public HTTPS address that reaches the app running on your Mac. Scape gets that address from a Cloudflare named tunnel that you own: you create the tunnel in your own Cloudflare account, paste three values into Scape, and Scape runs the tunnel for you.

How it fits together

You own the tunnel; Scape drives it. Concretely:

You create a Cloudflare named tunnel and a public hostname (a one-time setup, done with the cloudflared command-line tool).
Scape takes the hostname, tunnel ID, and credentials you paste in and runs its own bundled cloudflared to keep the tunnel connected while the app is open. You never run cloudflared tunnel run yourself — Scape does it.
Cloudflare routes the public hostname to that tunnel and delivers incoming requests to Scape.

Rotating or deleting the tunnel is always done in Cloudflare. Scape never modifies your Cloudflare account — it only connects using the credentials you give it.

What you'll need

A Cloudflare account (the free plan is enough).
A domain (zone) in that account. The public hostname you use must be a subdomain of a zone Cloudflare manages for you — e.g. hooks.example.com on the example.com zone.
The cloudflared command-line tool installed on your Mac.

Step by step

1. Create a free Cloudflare account

2. Add a domain (zone) you control

In the Cloudflare dashboard, add the domain you want to use (or use one you've already added). Cloudflare will walk you through pointing the domain's nameservers at Cloudflare. The hostname you give Scape must live on a zone in this account — that's how Cloudflare knows the DNS record it creates belongs to you.

3. Install `cloudflared`

On macOS with Homebrew:

brew install cloudflared

Other install methods are in Cloudflare's downloads page. You only need cloudflared for the one-time setup below — Scape ships its own copy for actually running the tunnel.

4. Log in and pick your zone

cloudflared tunnel login

This opens your browser. Sign in and choose the zone (the domain from step 2). Cloudflare writes an authorization certificate to ~/.cloudflared/cert.pem — that's what lets the next two commands manage tunnels on your account.

5. Create the tunnel

Pick any name you like for the tunnel (it's just a label):

cloudflared tunnel create my-hooks

This prints a Tunnel ID — a UUID that looks like f9e8d7c6-b5a4-3210-9876-543210fedcba — and writes a credentials file to ~/.cloudflared/<TUNNEL-ID>.json (the file is named after the UUID). Keep both handy; you'll paste them into Scape.

6. Create the public hostname

Point the hostname you want to use at the tunnel. This creates a CNAME DNS record in your zone:

cloudflared tunnel route dns my-hooks hooks.example.com

Use the same tunnel name from step 5 and the hostname you want senders to call. hooks.example.com must be on the zone you picked in step 4.

7. Enter the values in Scape

Open Settings → General → Webhook Endpoint and fill in the three fields:

Field	What to paste
Ingress hostname	The bare public hostname from step 6 — e.g. `hooks.example.com`. No `https://`, port, path, or query.
Tunnel ID	The UUID printed in step 5 (the same value that appears as `"TunnelID"` inside the credentials file) — not the tunnel's name. See the note below.
Tunnel credentials JSON (from `cloudflared tunnel create`)	The full contents of the `~/.cloudflared/<TUNNEL-ID>.json` file (the JSON object with `AccountTag`, `TunnelID`, and `TunnelSecret`).

Click Save. Scape validates the values, stores the credentials in its local secret catalog, and brings the tunnel up automatically. That's it — no cloudflared tunnel run on your side.

What each field is

Ingress hostname — the public address senders will call (e.g. https://hooks.example.com/...). It must be a hostname on a zone in your Cloudflare account.
Tunnel ID — the UUID of your named tunnel. Scape hands this to its bundled cloudflared to run the right tunnel, and uses it to key the stored credentials.
Tunnel credentials JSON — the secret Cloudflare wrote when you created the tunnel. It's what proves to Cloudflare that Scape is allowed to run your tunnel.

Where your credentials live

The credentials JSON is stored in the local secret catalog — the bytes go into the macOS Keychain, tracked by a local database entry that points at the current Keychain item. The credentials never leave your Mac: they are handed to the bundled cloudflared in memory at launch and are never written to disk in plaintext or logged. Scape clears the pasted text from the input field the moment you Save.

Managing and removing the tunnel

Rotating or deleting the tunnel is done in Cloudflare (via the dashboard or cloudflared). Scape never changes your Cloudflare account. If you rotate the tunnel's credentials, paste the new credentials JSON into Scape and Save again.
Reset clears the endpoint configuration in Scape and normally removes the stored credentials from the local secret catalog. It's deliberately always available — even without a subscription — so you can clear a broken or unwanted configuration at any time. If the credentials can't be cleared from the Keychain, Scape tells you and keeps the entry so you can press Reset again to retry — it never reports a failed clear as success. Reset does not touch anything in your Cloudflare account.