When incoming webhook receives sensitive data, create time-limited secret and forward via Telegram notification
Post sensitive data to a FlowMattic webhook and this workflow wraps it in an expiring Share Secrets link, then sends that link to Telegram, so the chat holds a link instead of the raw value.
Webhook
Share Secrets
Telegram3 steps Setup ~5 min Used on 2.1k sites Free to import
What this workflow does
Passwords, API keys and access codes often get pasted straight into chat, where they stay in the history for anyone who scrolls back. If another system produces those values, you can send them through a webhook and share a link to them instead. This workflow does that hand-off for you.
The flow opens with a Webhook trigger that listens for secrets. FlowMattic gives you a URL, and whatever system holds the secret posts it there along with any other fields you include. The next step uses Share Secrets to turn the value you map into a secure, expiring link. The last step sends a message through Telegram with that link, so the recipient opens the secret from the link rather than reading it in the chat.
Any system that can send an HTTP request can start the flow: an internal script, a provisioning tool or another workflow. Keep in mind that FlowMattic records each run in Task History, including the data the webhook received, so decide who on your site can view Task History before you send real secrets through it.
New staff account credentials
When your provisioning script creates an account, it posts the temporary password to the webhook, and the new starter's manager gets a Telegram message with a secret link to pass on.
Rotated API keys for a developer
A key rotation job sends the new key to the webhook, and the developer who needs it receives an expiring link in Telegram instead of the key in plain text.
Client access details from a form tool
A form or helpdesk tool that can send webhooks posts a client's login details, and your team chat receives a link to them rather than the details themselves.
How this workflow runs
What happens at each step once the workflow is on, and what you need before you import it.
Webhook Capture Webhook ResponseGives you a webhook URL that receives data from another system. Send the sensitive value and any context fields in the request, and FlowMattic captures them for the next steps.
- Share Secrets Create Secret Link
Creates a secure, expiring link in Share Secrets from the value you map out of the webhook data. The link it returns is what the Telegram step sends, not the original value.
- Telegram Send a Text Message
Sends a text message through Telegram that includes the Share Secrets link. Write the message, insert the link from the previous step, and connect your Telegram bot on import.
What you need
- FlowMatticCore
- Telegram AccountAccount
After importing, map your own data. To keep the template universal, not every step is pre-filled. Open each step in the builder and connect your accounts and fields (channels, lists, sheets, recipients) before you switch the workflow on.
Make it yours
Changes worth making after you import it.
- Map only the link into the Telegram message, never the original webhook field, so the secret itself doesn't end up in your chat history.
- Add a Filter after the webhook that continues only when a shared token field matches a value you choose, so random requests to the URL don't create links.
- Send a test request with a dummy value after import so FlowMattic captures the payload, then map the fields in both later steps before using real data.
Questions about this workflow
What can send data to this webhook?
Any app, script or service that can make an HTTP request to the URL FlowMattic gives you. Include the secret and any fields you want in the Telegram message.
Does the secret appear in the Telegram message?
Only if you map it there. As designed, the Telegram step sends the Share Secrets link, and the person opens the value from that link.
Is the secret stored anywhere in FlowMattic?
FlowMattic keeps a record of each run in Task History, including the data the webhook received. Limit who can view Task History, or clear old runs, if that matters for your secrets.
How long does the Share Secrets link last?
The link is an expiring one. Check the options in the Create Secret Link step after import to see how its expiry is set.
More Developer Tools workflows
Other ready-to-import templates from the same category.
Import this workflow into your WordPress site
Download the JSON, import it from the Workflows screen and connect your accounts. Every run stays on your server, with no per-task fees.
30-day money-back guarantee Unlimited workflows and runs Self-hosted