# Subscribe a Webhook to get WhatsApp flows results {{}} Connect an HTTPS endpoint to Truora so your system receives the result of every WhatsApp Flow — when a user starts it, when it finishes successfully, and when it fails. This guide walks you through configuring the rule that triggers the webhook and covers how the JWT payload is signed so your endpoint can verify it. ## How to configure a Rule? 1. Log in to [**Truora's platform**](https://account.truora.com/account#/auth/login). 2. From the sidebar menu, select **Webhooks/Automations**. 3. Click on the "**New Rule**" button to begin setting up a new webhook rule. 4. Enter the name of your rule in the **Rule Name** field. Optionally, provide a brief description in the **Description** field. 5. Under **Product**, choose **Customer Engagement** and under **subproduct**, select **WhatsApp Flows**. {{ select_product

}} 6. The **WhatsApp Flows** sub product includes the following three events. You can select multiple events if needed, as different events might trigger the same actions based on your specific use case: - **Started:** Triggered when the user initiates a WhatsApp flow. - **Success:** Triggered when the WhatsApp flow is completed or successful according to the defined conditions. - **Failed:** Triggered when the WhatsApp flow is not completed or fails according to the defined conditions. 7. Select the events from the list and click **Save activator**. {{ select_event

}} 8. **Optional:** Based on the events and variables ({{< newtab href="/guides/webhook_events_and_variables/#list-of-events-and-their-variables" >}}List of events and their variables{{< /newtab >}}) you can define additional conditions that must be met alongside the trigger. To add conditions, click **+Add conditions**. {{ add_condition

}} 9. Scroll down to the **Action** section and select **Notification via webhook**. 10. Configure the **Notification via webhook** action: - Assign an identifier name. - Provide an email to receive Webhook status updates or changes. - **Optional:** If the endpoint for receiving Webhook notifications requires credentials, ensure they are added. - Select the HTTP method and enter the URL for the Webhook. - **Optional:** Add any required parameters or headers. > **Note**: The webhook will send its response payload in JWT format to the specified endpoint. A brief explanation of JWTs is provided later in this guide. 11. Finally, save the action and save the rule: - Click **Save action**. - If no additional actions are needed, click **Save actions**. - Lastly, click **Finalize rule configuration** to add the rule to your list of configured rules. {{ action_config

}} **You are all set!** Your rule has been created successfully! You can now view its name, ID, status, and creation date in your list of rules. To edit, disable, or delete the rule, click the three dots button on the right. Feel free to explore, create additional rules, and check out the other events we support! {{ rules_list

}} --- ## What is a JWT? A JSON Web Token (JWT) is a Base64-encoded string used for authentication and the secure transfer of information between two parties. A JWT consists of three parts separated by periods (.), formatted as <

>.<>.<>. Example:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.83a9Oh1v7AAKfEr4BXxZC44gNiOb_OJ7PI3mEO4rwXE

- Header: Contains the type of token and the encryption algorithm used. - Payload: Includes the information to be transmitted, usually in JSON format. - Signature: Ensures the integrity of the token, allowing verification that the JWT was issued by the legitimate source and has not been tampered with. ## How to Decode a JWT? There are several libraries available in different programming languages that allow you to decode and verify a JWT. Some of the most popular include jsonwebtoken for JavaScript, jwt-simple for Python, and jjwt for Java, among others. In this guide, an example will be provided using the jsonwebtoken library in JavaScript. To decode and verify a JWT, you can use the jwt.verify(...) function from jsonwebtoken. This function takes the token as the first argument and the secret key used to generate the signature as the second argument. If the signature and algorithm match, the token is valid; otherwise, it will be considered tampered with. {{

}}
    const jwt = require("jsonwebtoken");
    
    function parseJwt (token) {
       try {
           const decoded = jwt.verify(token, "c48863adab6b101b79f08ddb2cfe1b1c3f2ff7eb38fa01a14904dde971c2193b");
           console.log(JSON.stringify(decoded, null, "\t"));
         } catch (err) {
           console.log(err);
         }
    }

    parseJwt(
     "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.83a9Oh1v7AAKfEr4BXxZC44gNiOb_OJ7PI3mEO4rwXE"
    );

{{

}}