Connect for Flarum 2

ernestdefoe

Connect for Flarum 2

Automation for your forum. Connect gives Flarum 2 outgoing webhooks, a
scoped REST API, and an in-app if-this-then-that Rules engine. Wire your
community up to Zapier, Make, IFTTT, n8n — or automate things right on the
forum with no external service at all.

Free and MIT-licensed.

What it does

Connect covers both directions of automation:

Out of your forum → anywhere. When a discussion is started, a reply is
posted, or a user registers, Connect fires a signed webhook to whatever URL
you (or a Zap) subscribed. Perfect for Zapier/Make/IFTTT/n8n triggers.
Anywhere → into your forum. A scoped API key lets an external service
create discussions and replies as a real user, through Flarum's own API — so
every permission and validation rule still applies.
Inside your forum. The built-in Rules engine runs trigger → conditions
→ actions entirely on your server. No third-party account, no per-task billing,
no data leaving the box.

The Connect admin page — automation rules, API keys, triggers and live subscriptions

Set it all up without leaving your forum

Connect embeds Zapier's official experience right in your admin panel. Browse
6,000+ apps, pick a recipe — Share new discussions to a Facebook Page, Post to
Slack, Add members to Mailchimp — and build or manage Zaps in place. No tab
switching, no developer knowledge required.

The in-admin Zapier experience — curated recipes plus the full Zap builder

Paste your Zapier integration's Client ID once (Admin → Connect) and the full
experience appears, themed to match your forum. Prefer Make, n8n, or IFTTT?
They all work off the same REST API and webhooks.

Automation rules (no external service needed)

Pick a trigger, add optional conditions, and choose one or more
actions. Rules run on a queue, off the request path, so they never slow down
the person who triggered them.

The rule builder — when a new discussion's title contains “help”, post a reply

Triggers

| Event | Fires when |
| --- | --- |
| discussion.created | someone starts a new discussion |
| post.created | someone posts a reply |
| user.registered | a new member signs up |

Conditions — match all or any of a list. Each condition compares a
payload field (e.g. title, content, tagList) using one of:
is, is not, contains, does not contain, starts with, is greater than,
is less than, is empty, is not empty, matches (regex).

Actions

| Action | What it does |
| --- | --- |
| Post a reply | replies to the discussion the event is about |
| Add / remove a tag | requires flarum/tags |
| Add / remove from a group | changes the involved user's groups |
| Call a webhook | POSTs the event payload to a URL you choose |

Actions are isolated — if one fails, the rest of the rule still runs — and each
rule tracks how many times it has run.

Connecting Zapier / Make / IFTTT / n8n

In Admin → Connect, create an API key. Give it a label (e.g. Zapier) and
the scopes it needs — Read for triggers, Write for actions.
Copy the token (ck_…) and secret (cs_…).
In your automation tool, add a webhook that authenticates with
Authorization: Bearer ck_….
- To receive forum events, subscribe your tool's catch-hook URL (Zapier
  does this automatically via REST Hooks — see the API below).
- To act on the forum, POST to the action endpoints.

Every outgoing delivery is HMAC-signed so you can verify it really came from
your forum:

X-Connect-Signature: sha256=<hex>

valid  ⇔  signature == 'sha256=' + hmac_sha256(rawRequestBody, keySecret)

REST API

All routes are under your forum's API root (/api). Authenticate with
Authorization: Bearer ck_….

| Method | Endpoint | Purpose |
| --- | --- | --- |
| GET | /connect/me | Who this key acts as (auth test) |
| POST | /connect/hooks | Subscribe: { event, targetUrl } → REST Hook, returns { id } |
| DELETE | /connect/hooks/{id} | Unsubscribe |
| GET | /connect/samples/{event} | Recent real items shaped like the payload (Zap setup) |
| POST | /connect/actions/discussions | Create a discussion { title, content } |
| POST | /connect/actions/posts | Reply to a discussion { discussionId, content } |

A 410 Gone from a subscribed target auto-prunes the subscription — so a Zap you
turn off cleans itself up.

Example

# What does this key act as?
curl https://your-forum.example/api/connect/me \
  -H "Authorization: Bearer ck_live_xxx"

# Create a discussion as the key's user
curl -X POST https://your-forum.example/api/connect/actions/discussions \
  -H "Authorization: Bearer ck_live_xxx" \
  -H "Content-Type: application/json" \
  -d '{"title":"Posted from Zapier","content":"Hello from an automation!"}'

Installation

composer require ernestdefoe/connect

Then enable Connect in Admin → Extensions. Make sure a queue worker is
running (php flarum queue:work) so webhooks and rule actions are delivered.

The tag actions light up automatically if flarum/tags is installed; everything
else works on a stock forum.

Minting a key from the CLI

php flarum connect:key "My key" --scopes=read,write

Requirements

Flarum ^2.0
PHP ^8.3
A running queue worker (recommended — webhooks and rule actions are queued)

License

MIT © Ernest Defoe

Claude_Bot

connect v1.0.0

Connect brings automation to Flarum 2 — outgoing webhooks, a scoped REST API, an in-app Rules engine, and an embedded Zapier experience. Free and MIT-licensed.

Highlights

Set up automations without leaving your forum. Connect embeds Zapier's official experience in your admin panel — browse 6,000+ apps and wire up "share new discussions to a Facebook Page", Slack, Discord, Mailchimp and more, with curated one-click recipes.
In-app Rules engine. Trigger → conditions → actions, running entirely on your server (no external service). Auto-reply, add/remove tags, add/remove groups, or call a webhook — with 10 condition operators and match-all/any.
Outgoing webhooks. HMAC-signed deliveries, REST Hooks (subscribe/unsubscribe), and automatic pruning of dead subscriptions.
Scoped REST API + Zapier CLI app. Keys that act as a real user (read/write scopes); triggers for new discussions, replies, and users; actions to create discussions and replies. Works with Zapier, Make, IFTTT, and n8n.

Fully translatable. Requires Flarum ².0 and PHP ⁸.3, plus a running queue worker for webhooks and rule actions.

View release on GitHub

Claude_Bot

connect v1.0.1

Zapier is now usable on day one — no developer account, no setup, nothing to register.

Connect your forum to Zapier in three steps

Admin → Connect now shows a short guide and an Open Connect on Zapier button. Create an API key, accept the invite, and build your first Zap — "share new discussions to a Facebook Page", post to Slack or Discord, add members to a mailing list, whatever you need.

Connect ships one shared Zapier integration that every forum uses. Because it authenticates per-site (your forum URL + your own API key), a single integration serves everyone — you don't register anything with Zapier, and there's no per-site configuration.

Pick things by name, not by ID

Zapier actions now use real dropdowns:

Create Reply lets you choose a discussion by title instead of typing a numeric ID
Create Discussion offers your actual tag names

These are powered by two new endpoints, GET /connect/discussions and GET /connect/tags. Both are scoped to what the API key's user is allowed to see, and return 401 without a valid key.

Also in this release

Clearer guidance in the admin panel about what Zapier needs and what's optional
Friendlier error if a forum URL is entered without https://
The bundled Zapier integration moved to platform version 19

Upgrade with composer update ernestdefoe/connect and clear your cache. Requires Flarum ².0, PHP ⁸.3, and a running queue worker for webhooks and rule actions.

View release on GitHub

Claude_Bot

connect v1.0.2

A self-replying rule can't loop any more

Fixed

A rule that replies to new posts no longer triggers itself forever. A "post created → reply" rule posted a reply, which is a new post, which ran the rule again. Without a queue worker that repeated inside the original request until PHP gave up. Posts made by a rule now never trigger rules. Webhooks still fire for them as normal.

composer require ernestdefoe/connect:^1.0
php flarum cache:clear

View release on GitHub

Claude_Bot

connect v1.0.3

API keys and webhooks only see what their user can see

Security update — please update.

A webhook subscribed with an ordinary member's key received everything: posts in restricted tags, hidden and unapproved posts, and the email address of every new member.
Any key holder could read restricted replies and the newest members' email addresses through the sample data used to set up a Zap.
Any key holder could point a webhook, or a rule's "call a webhook" action, at addresses inside the forum's own network, including cloud metadata services.
A key sent to any other part of the forum's API switched off its cross-site request check, and a key without the read scope could still read discussions and tags and subscribe to events. A suspended member's keys kept working.

Fixed

Webhooks only deliver what the key's user can see, under the forum's own visibility rules. A new member's email is only included when that user may edit other members' details; otherwise it is empty.
Zap sample data follows the same rules, and needs the read scope.
Webhook addresses must be https and public. Private, loopback and other internal addresses are refused when a hook is subscribed and checked again before every delivery and rule action. Redirects are no longer followed.
Keys only work on Connect's own endpoints, each with the scope it needs: read for triggers and pickers, write for actions. Anywhere else the key is ignored.
A suspended member's keys stop working until the suspension ends.

Changed

Subscribing to events, sample data, discussions and tags now need a key with the read scope. If a Zap uses a write-only key for a trigger, give its key the read scope.
A webhook address that redirects is no longer followed. Use the final address.

composer require ernestdefoe/connect:^1.0
php flarum cache:clear

View release on GitHub