Mailhook vs. Email trigger
Spojit has two ways to start a workflow from email. They solve different problems:
If you can point the sender at a new address, a mailhook is the simpler option. If the mail is already flowing into a real inbox you can’t change, use the Email trigger.
Setup
- Select the trigger node, set Trigger Type to Mailhook.
- Optional: enter an Address prefix (see below). Leave it empty for the default
mh. - Click Generate email address. The address appears immediately with a copy button.
- Point mail at it: add it to a vendor’s notification settings, create a forwarding rule in your mail client, or use it directly as a “send results here” address in another system.
- Optional: add a From allowlist or Subject regex filter, then Save workflow.
The address
Addresses have the shape<prefix>-<random>@mailhook.spojit.com:
- The random part is 16 characters of cryptographically random base32. This is what makes the address unguessable; treat it like a capability. Anyone who knows the full address can start the workflow (subject to your filters).
- The prefix is cosmetic and yours to choose: 1 to 24 lowercase letters, digits, or hyphens.
invoices,support-intake,crm-sync. Defaults tomh. A recognizable prefix makes forwarding rules and audit logs easier to read.
Filters
Two optional filters narrow what fires a run. They are the same filters the Email trigger uses:- From allowlist: comma-separated patterns.
@acme.commatches any sender at acme.com;orders@vendor.commatches the exact address. Multiple patterns are OR’d. - Subject regex: a JavaScript-flavor regular expression. The message fires only if the subject matches.
Sender addresses are trivially spoofable in email. The allowlist is a routing convenience, not an authentication mechanism. The real access control is the unguessable address itself; rotate it if it leaks.
Rotating the address
Click Regenerate address in the trigger properties panel. A new random address is generated and the old address stops working immediately: mail sent to it is silently discarded. There is no grace period, so update your forwarding rules and vendor settings right after rotating. Rotate whenever the address has spread further than you intended (posted in a ticket, shared with a vendor you’ve offboarded, leaked in a screenshot).Workflow input
The parsed message is the trigger’s output, available to downstream nodes as{{ input }}:
Behavior notes
- Always asynchronous. The sender gets no response; there is no sync mode for mailhooks. Use a Send Email node in the workflow if you want to reply to
{{ input.replyTo }}. - Deduplicated per message. If the inbound provider retries delivery of the same message, the workflow still runs once.
- Any recipient field counts. The mailhook fires whether its address is in To, Cc, or Bcc.
- One email, many mailhooks. A single message addressed to the mailhook addresses of several workflows fires each of them independently.
- Unknown addresses are accepted silently. Mail to a rotated or deleted address is discarded without bouncing, so a leaked old address reveals nothing about whether it’s still live.
Tips
- Use one mailhook per source. Separate addresses for “vendor A invoices” and “vendor B invoices” cost nothing and keep filters simple, and you can rotate one without disturbing the other.
- Pair a mailhook with a forwarding rule in your mail client to mirror a slice of a real inbox into a workflow without connecting the mailbox at all.
- Prefer the subject regex over a broad allowlist when the same sender emails you for multiple reasons.
- For testing, email the address from your own account and watch the run appear in Monitoring.