Automations

An automation sends a message when something happens to a shopper. For example, a shopper leaves a cart behind. The message goes out on its own.

Status: on by default. Messages need push keys and the shopper's permission.

Built-in flows#

Abandoned cart
Abandoned checkout
Abandoned browse
Back in stock
Price drop
Welcome
Win-back
Order status

How a flow runs#

A trigger starts the flow for one shopper. For example, a cart is left for a while.
Delayed steps wait. Conditions check the shopper again before each step.
Exit rules stop the flow. For example, the shopper buys, or opts out.
Each message goes through the same checks as a campaign: permission, quiet hours and frequency caps.

If a message is blocked for one reason, the flow may carry on to the next step. If the shopper has no push permission, the flow stops.

Settings#

Open Automations and pick a flow. Turn it on or off, then set its timing and text. Use Automation settings for the rules that apply to every flow.

Plan lapse#

If the app's plan is not active, messages from automations are held back. The run continues, and the reason shows in the run history.

Webhook steps and the signing secret#

A webhook step sends the event to your own server as a POST with a JSON body. Each automation has its own signing secret, so your server can check that a request really came from this app.

Open the automation. Under Webhook signing secret, press Generate signing secret.
Copy the secret straight away. It is shown only once. Later the page shows only its last four characters.
To replace it, press Rotate secret. The old secret stops working at once, so update your server right after.

Each request carries these headers:

x-automation-timestamp: the time of sending, in seconds since 1 January 1970 (UTC).
x-automation-signature: sha256= followed by the HMAC-SHA256 of <timestamp>.<raw body> with your secret, in lowercase hex.
x-automation-event: the event name.
idempotency-key: the same value when a request is retried, so you can ignore repeats.

To check a request: join the timestamp header, a full stop and the raw body exactly as received; compute HMAC-SHA256 with your secret; compare it with the signature header using a constant-time comparison. Reject the request if the signature does not match or if the timestamp is more than 5 minutes away from your clock.

Example (Node.js):

const crypto = require("node:crypto");
function verify(secret, headers, rawBody) {
  const ts = Number(headers["x-automation-timestamp"]);
  if (!Number.isFinite(ts) || Math.abs(Date.now() / 1000 - ts) > 300) return false;
  const want = Buffer.from("sha256=" + crypto.createHmac("sha256", secret).update(`${ts}.${rawBody}`).digest("hex"));
  const got = Buffer.from(String(headers["x-automation-signature"] || ""));
  return got.length === want.length && crypto.timingSafeEqual(got, want);
}

The body can include the shopper's customer id, device id and the event data. Only send it to a server you control.