Pipedream

Pipedream is a developer-first workflow platform. It gives you a visual builder like Zapier but lets you drop in arbitrary Node.js, Python, Bash, or Go steps when the no-code path runs out. Crove plugs into Pipedream through its standard webhook surface — no Pipedream-specific plugin required.

What you can build

• Stripe → Crove: A successful Stripe payment fires a subscription agreement document with the customer's plan tier pre-filled
• Crove → Supabase: Every completed Crove document inserts a row into your Supabase contracts table with the parsed response JSON
• GitHub Issue → Crove: A new GitHub Security issue triggers an incident-report document addressed to your legal team
• Custom validation: A Pipedream Node.js step rejects a Crove webhook payload if the signer's company domain doesn't match your allowlist

Setup overview

Pipedream → Crove (action)

1. In Pipedream, add a step after your trigger and pick HTTP / Webhook → Send any HTTP request.
2. Set the URL to https://crove.app/api/external/v1/documents, method POST, and add an Authorization: Bearer <YOUR_API_KEY> header. Mint the key at Settings → API Keys in Crove and store it in Pipedream's environment variables rather than hardcoding.
3. Set the body to JSON:

   {
     "templateId": "<TEMPLATE_ID>",
     "name": "Subscription — {{ steps.trigger.event.customer.name }}",
     "signers": [
       {
         "email": "{{ steps.trigger.event.customer.email }}",
         "role": "default"
       }
     ]
   }

4. Deploy the workflow. Pipedream will log every fire with the full request and response so you can debug against real data.

Crove → Pipedream (trigger)

1. In Pipedream, create a new workflow with an HTTP / Webhook trigger. Copy the trigger URL Pipedream gives you.
2. In Crove, go to Settings → Webhooks and paste the trigger URL as a new outgoing webhook. Select which events to subscribe to — document.completed is the most common, but all 30 event types are available.
3. Save. Pipedream will receive a payload every time the subscribed event fires. The payload schema lives at /docs/webhooks/outgoing-webhooks.

Verifying the webhook signature

Every outgoing Crove webhook is signed with an HMAC-SHA256 of the body using the secret from Settings → Webhooks. Verify in Pipedream with a Node.js code step:

import crypto from "crypto";

export default defineComponent({
  async run({ steps, $ }) {
    const secret = process.env.CROVE_WEBHOOK_SECRET;
    const header = steps.trigger.event.headers["x-crove-signature"];
    const [tPart, vPart] = header.split(",");
    const ts = tPart.split("=")[1];
    const sig = vPart.split("=")[1];
    const signed = crypto
      .createHmac("sha256", secret)
      .update(ts + "." + JSON.stringify(steps.trigger.event.body))
      .digest("hex");
    if (signed !== sig) $.flow.exit("Invalid signature");
  },
});

Reject any payload whose signature doesn't match — that's how you make sure the request actually came from Crove and not a replay.

Pricing gotchas

Pipedream has a generous free tier (10k invocations/month) so most Crove workloads run free. Custom Node.js steps consume compute credits, not invocation credits, so watch your plan if you use long-running steps.