# Not able to create an Asana Webhook to Okta Workflows **URL:** \ **Category:** Questions\ **Created:** [February 24, 2026, 1:24am UTC](https://devforum.okta.com/t/not-able-to-create-an-asana-webhook-to-okta-workflows/35084 "2026-02-24T01:24:06Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![rcortez](https://avatars.discourse-cdn.com/v4/letter/r/f05b48/32.png) [@rcortez](https://devforum.okta.com/u/rcortez)\ **Post date:** [February 24, 2026, 1:24am UTC](https://devforum.okta.com/t/not-able-to-create-an-asana-webhook-to-okta-workflows/35084/1 "2026-02-24T01:24:06Z")
The Asana POST is expecting a 200 with the header key pair X-Hook-Secret: {value 1st card}. I’m using the Return Raw card, status = 200, and the header constructed from the API card headers. A simple test to the flow from VSCode, > POST [https://arcinstitute.workflows.okta.com/api/flo/](https://arcinstitute.workflows.okta.com/api/flo/){Secure with client token} > > Content-Type: application/json > > x-hook-secret: test-secret-12345 The VSCode response shows x-azuqua-x-hook-secret: test-secret-12345 Could this be the problem with Asana not creating the webhook? ---
**Author:** ![maxkatz](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/maxkatz/32/5624_2.png) [@maxkatz](https://devforum.okta.com/u/maxkatz)\ **Post date:** [February 24, 2026, 1:37am UTC](https://devforum.okta.com/t/not-able-to-create-an-asana-webhook-to-okta-workflows/35084/2 "2026-02-24T01:37:43Z")
Hi @rcortez, Could you share screenshots of how the request appears in Asana and of your flow? ---
**Author:** ![rcortez](https://avatars.discourse-cdn.com/v4/letter/r/f05b48/32.png) [@rcortez](https://devforum.okta.com/u/rcortez)\ **Post date:** [February 24, 2026, 4:33am UTC](https://devforum.okta.com/t/not-able-to-create-an-asana-webhook-to-okta-workflows/35084/3 "2026-02-24T04:33:12Z")
Hi Max, There’s nothing in Asana. I’m simply following the steps here, [https://developers.asana.com/reference/createwebhook](https://developers.asana.com/reference/createwebhook) Using my credential key and the target url as the Okta api. This my okta workflow ![image](https://global.discourse-cdn.com/oktadev/original/2X/5/5800093f7adfb1b82fd5d35ea4f2134200a2bdb2.png) ---
**Author:** ![maxkatz](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/maxkatz/32/5624_2.png) [@maxkatz](https://devforum.okta.com/u/maxkatz)\ **Post date:** [February 24, 2026, 8:14pm UTC](https://devforum.okta.com/t/not-able-to-create-an-asana-webhook-to-okta-workflows/35084/4 "2026-02-24T20:14:40Z")
Does the above flow work? Do you have another flow that registers the webhook? The flow you shared looks correct. When you register your webhook, Asana will send a request to the webhook (Workflows API endpoint), and you need to return the secret handshake via the X-Hook-Secret response header. ---
**Author:** ![rcortez](https://avatars.discourse-cdn.com/v4/letter/r/f05b48/32.png) [@rcortez](https://devforum.okta.com/u/rcortez)\ **Post date:** [February 24, 2026, 10:08pm UTC](https://devforum.okta.com/t/not-able-to-create-an-asana-webhook-to-okta-workflows/35084/5 "2026-02-24T22:08:02Z")
The flow does respond but it sends in the header x-azuqua-x-hook-secret:….., so Asana fails to create the webhook. [Make.com](http://Make.com) successfully creates an Asana webhook to a [make.com](http://make.com) scenario. This app correctly responded with “x-hook-secret”: in the header. It looks like the raw response card appends x-azuqua- Here’s the full response using the flow and the VScode describe at the start of this. HTTP/1.1 200 OK Date: Tue, 24 Feb 2026 22:05:06 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close surrogate-control: no-store cache-control: no-store, no-cache, must-revalidate, proxy-revalidate expires: 0 access-control-allow-origin: \* access-control-allow-headers: Origin,X-Requested-With,Content-Type,Accept content-security-policy: default-src ‘self’;script-src ‘self’ ‘unsafe-inline’;style-src ‘self’ ‘unsafe-inline’;font-src ‘self’;upgrade-insecure-requests;report-uri /api/system/report-csp strict-transport-security: max-age=31536000; includeSubDomains x-content-type-options: nosniff x-download-options: noopen x-xss-protection: 0 x-azuqua-trace-id: 6e9a291b-c0a8-410d-ad4f-4d1c4c628e64 x-azuqua-span-id: 6e9a291b-c0a8-410d-ad4f-4d1c4c628e64 access-control-expose-headers: x-flo-instance x-flo-instance: 1eaeb276-3815-425a-9ba5-8a68bfa4d5dc x-azuqua-x-hook-secret: test-secret-12345 x-flo-execution: 1eaeb276-3815-425a-9ba5-8a68bfa4d5dc etag: W/“0-2jmj7l5rSw0yVb/vlWAYkK/YBwk” x-envoy-upstream-service-time: 251 server: istio-envoy Sorry for not being very clear at the start of this thread. Thanks ---
**Author:** ![maxkatz](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/maxkatz/32/5624_2.png) [@maxkatz](https://devforum.okta.com/u/maxkatz)\ **Post date:** [February 24, 2026, 11:08pm UTC](https://devforum.okta.com/t/not-able-to-create-an-asana-webhook-to-okta-workflows/35084/6 "2026-02-24T23:08:09Z")
I reproduced the same issue. Workflows modifies the response header and sends back `x-azuqua-x-hook-secret`. It’s a bug. To prioritize this bug, can you create a support case? Could you also DM me the case number? You can also email it to me ([max.katz@okta.com](mailto:max.katz@okta.com)). ---
**Author:** ![rcortez](https://avatars.discourse-cdn.com/v4/letter/r/f05b48/32.png) [@rcortez](https://devforum.okta.com/u/rcortez)\ **Post date:** [April 16, 2026, 9:26pm UTC](https://devforum.okta.com/t/not-able-to-create-an-asana-webhook-to-okta-workflows/35084/8 "2026-04-16T21:26:01Z")
Hi Max, Engineering fixed the bug, where the header no longer prepends x-azuqua on x-hook-secret. I have on okta workflow with the 1st card, on demand API. The webhook I want to create has the endpoint api in the body, along with other data. Using the POST to create the webhook from the Asana UI or VScode the response is “errors”: [ { “message”: “The remote server which is intended to receive the webhook did not respond with the handshake secret.”, “help”: “For more information on API status codes and how to handle them, read the docs on errors: [Errors](https://developers.asana.com/docs/errors)” } ] Is suspect the endpoint card is responding without including the x-hook-secret. How do I create the Asana webhook to an Okta workflow target? Thanks ---
**Author:** ![maxkatz](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/maxkatz/32/5624_2.png) [@maxkatz](https://devforum.okta.com/u/maxkatz)\ **Post date:** [May 5, 2026, 4:54pm UTC](https://devforum.okta.com/t/not-able-to-create-an-asana-webhook-to-okta-workflows/35084/9 "2026-05-05T16:54:28Z")
Hi @jcortez, sorry I missed the last message. Does the flow send the response (with the secret) back to Asana? Some webhooks require a one-time response (with the secret) to validate the API endpoint. You no longer need to send it again once it’s validated. ---
**Author:** ![rcortez](https://avatars.discourse-cdn.com/v4/letter/r/f05b48/32.png) [@rcortez](https://devforum.okta.com/u/rcortez)\ **Post date:** [May 5, 2026, 7:42pm UTC](https://devforum.okta.com/t/not-able-to-create-an-asana-webhook-to-okta-workflows/35084/10 "2026-05-05T19:42:45Z")
Hi Max, I’m fairly certain the response with the secret needs to happen on the 1st card, Okta API Endpoint. This flow was an experiment so a solution isn’t urgent. Thanks ---
**Author:** ![maxkatz](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/maxkatz/32/5624_2.png) [@maxkatz](https://devforum.okta.com/u/maxkatz)\ **Post date:** [May 6, 2026, 8:53pm UTC](https://devforum.okta.com/t/not-able-to-create-an-asana-webhook-to-okta-workflows/35084/11 "2026-05-06T20:53:56Z")
It can look something like this: ![image](https://global.discourse-cdn.com/oktadev/original/2X/4/4da5008f7fd0eb72723d8280a2ec02af50f586f8.png) Does it need the secret for every response? Usually, once you validate the API endpoint, you no longer need to send the secret.