Triggers
How workflows start — schedule, webhook, or Composio event.
Workflows is in Beta. The UI and API may change. The sidebar entry is currently disabled for most workspaces — your account team enables it for pilot orgs.
Every workflow has at least one trigger. A trigger is what causes the workflow to run.
| Trigger | Fires when |
|---|---|
| Schedule | A cron expression matches. Per-timezone. |
| Webhook | An authenticated HTTP request hits the workflow's URL. |
| Composio | A connected third-party service emits a matching event (e.g., new Gmail message). |
Schedule triggers
Configure a Schedule trigger with a cron expression and a timezone. Convex's scheduler fires the next run when the expression matches. Disabling the trigger cancels the pending scheduler job. Re-enabling re-arms it using the same cron expression.
Webhook triggers
Each webhook trigger gets a unique URL and a generated HMAC signing secret. The secret is shown once at creation time. Rotate it at any time via the Rotate secret dialog — past values are not retained, so update your caller before rotating.
Incoming requests are verified by HMAC signature. Requests with a missing or mismatched signature are rejected with a 401. The request body is parsed and exposed to downstream nodes as the trigger's output.
Composio triggers
The Composio trigger picker has three steps:
Step 1: Integration — pick a connected third-party integration. Only active connections are shown.
Step 2: Trigger — pick the event on that integration (e.g., new_gmail_message).
Step 3: Configuration — fill in the trigger's schema. Fields vary by integration; a Gmail label trigger, for example, asks for a label name.
If the subscription to Composio partially fails — the trigger row saves but Composio rejects the subscription — the UI surfaces the orphan trigger ID so you can clean it up from the Triggers tab.
Disabling vs. removing
Disable keeps all configuration but stops the trigger from firing. A disabled Schedule trigger cancels its pending scheduler job; a disabled Composio trigger suspends the external subscription.
Remove deletes the trigger row entirely and tears down any external side effects: the Composio subscription is cancelled and the scheduler job is deleted. There is no recovery after removal.