Add a human approval step to any workflow

1. Create a Zap that starts with Webhooks by Zapier → Catch Hook and copy its hook URL. This is where the decision will arrive.
2. In your main Zap, add an action step: Webhooks by Zapier → Custom Request, filled in with:
   Method POST

   URL https://rills.ai/api/tools/approval-gateway/approvals Copy

   Headers Authorization: Bearer apg_YOUR_KEY Copy

   Content-Type: application/json Copy

   Replace apg_YOUR_KEY with the key from your email.

3. Paste this into Data, swap in your catch hook URL from step 1, and change the title and message to match your workflow:

   {
     "title": "Refund $420 to Acme Corp",
     "message": "Order #1042 - customer reports a duplicate charge.",
     "callback_url": "https://hooks.zapier.com/hooks/catch/your-catch-hook",
     "metadata": { "order_id": "1042" }
   }

4. Add a step that sends approval_url (from the Custom Request's response) to whoever decides: Slack, email, SMS. They'll see a simple approve / reject page.
5. When they decide, your catch hook Zap runs with the decision:

   {
     "id": "Vt2jW9qX...",
     "status": "approved",
     "decided_at": "2026-06-12T15:04:05.000Z",
     "comment": "Verified the duplicate charge - go ahead.",
     "metadata": { "order_id": "1042" }
   }

On a plan without premium webhooks? Skip the catch hook and check the status with a GET request to https://rills.ai/api/tools/approval-gateway/approvals/<id> instead (same Authorization header).

Full walkthrough with screenshots: adding a human approval step in Zapier.

1. In a new scenario, add Webhooks → Custom webhook and copy its address. This is where the decision will arrive.
2. In your main scenario, add an HTTP → Make a request module, filled in with:
   Method POST

   URL https://rills.ai/api/tools/approval-gateway/approvals Copy

   Headers Authorization: Bearer apg_YOUR_KEY Copy

   Replace apg_YOUR_KEY with the key from your email.

3. Set the body type to Raw (JSON), paste this, and swap in your webhook address from step 1:

   {
     "title": "Refund $420 to Acme Corp",
     "message": "Order #1042 - customer reports a duplicate charge.",
     "callback_url": "https://hook.us1.make.com/your-custom-webhook",
     "metadata": { "order_id": "1042" }
   }

4. Use approval_url from the module's response in an email or Slack module. Whoever opens it sees a simple approve / reject page.
5. When they decide, your webhook scenario runs with the decision:

   {
     "id": "Vt2jW9qX...",
     "status": "approved",
     "decided_at": "2026-06-12T15:04:05.000Z",
     "comment": "Verified the duplicate charge - go ahead.",
     "metadata": { "order_id": "1042" }
   }

Full walkthrough with screenshots: human approval steps in Make.

1. Add an HTTP Request node, filled in with:
   Method POST

   URL https://rills.ai/api/tools/approval-gateway/approvals Copy

   Headers Authorization: Bearer apg_YOUR_KEY Copy

   Replace apg_YOUR_KEY with the key from your email.

2. Use this JSON body. The callback_url expression points at the Wait node's resume URL, so n8n fills it in for you:

   {
     "title": "Refund $420 to Acme Corp",
     "message": "Order #1042 - customer reports a duplicate charge.",
     "callback_url": "{{ $execution.resumeUrl }}",
     "metadata": { "order_id": "1042" }
   }

3. Add a Wait node right after, set to On webhook call. Your workflow sleeps at zero cost until the decision lands.
4. Send approval_url (from the HTTP Request node's response) with a Slack or email node. When the human decides, the workflow resumes with:

   {
     "id": "Vt2jW9qX...",
     "status": "approved",
     "decided_at": "2026-06-12T15:04:05.000Z",
     "comment": "Verified the duplicate charge - go ahead.",
     "metadata": { "order_id": "1042" }
   }

Full walkthrough with screenshots: human approval workflows in n8n.

If it can send an HTTPS request and receive one back, it can use the gateway. One request creates the approval; the decision arrives at your callback_url.

Create an approval

curl -X POST https://rills.ai/api/tools/approval-gateway/approvals \
  -H "Authorization: Bearer apg_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "Refund $420 to Acme Corp",
    "message": "Order #1042 - customer reports a duplicate charge.",
    "callback_url": "https://your-app.example.com/webhooks/approval",
    "metadata": { "order_id": "1042" }
  }'

Response

{
  "id": "Vt2jW9qX...",
  "approval_url": "https://rills.ai/approve/Vt2jW9qX...",
  "status": "pending",
  "expires_at": "2026-06-19T14:00:00.000Z"
}

Your callback receives

{
  "id": "Vt2jW9qX...",
  "status": "approved",
  "decided_at": "2026-06-12T15:04:05.000Z",
  "comment": "Verified the duplicate charge - go ahead.",
  "metadata": { "order_id": "1042" }
}

No webhook? Poll the status

curl https://rills.ai/api/tools/approval-gateway/approvals/Vt2jW9qX... \
  -H "Authorization: Bearer apg_YOUR_KEY"

{
  "id": "Vt2jW9qX...",
  "status": "pending",
  "decided_at": null,
  "comment": null,
  "expires_at": "2026-06-19T14:00:00.000Z"
}

const crypto = require("node:crypto");

function verifyRillsSignature(rawBody, headers, signingSecret) {
  const timestamp = headers["x-rills-timestamp"];
  // Reject stale callbacks (5 minute tolerance) to prevent replay.
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false;
  const expected =
    "sha256=" +
    crypto
      .createHmac("sha256", signingSecret)
      .update(timestamp + "." + rawBody)
      .digest("hex");
  const provided = headers["x-rills-signature"] ?? "";
  return (
    provided.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(provided), Buffer.from(expected))
  );
}