How to Send Webhooks from Google Sheets with Apps Script

Google Sheets is the ultimate lightweight database for quick projects—leads, invoices, signups, you name it. But the second you need to push that data to your CRM, a Slack channel, or a custom backend, manual exports become a massive pain. You need real-time webhooks.

I hit this exact wall last week. I was building a quick lead-routing tool and needed to fire an HTTP POST request to a Node.js endpoint every time a teammate marked a lead status as “Ready” in our sheet. Apps Script makes this incredibly easy, but if you don’t watch out for Google’s weird trigger limitations and silent permission failures, your script will just die in the background without telling you.

Here is how to build a bulletproof Apps Script webhook sender, set up the right triggers, avoid infinite loops when updating rows, and secure your payloads with secret headers.

The Setup: Preparing Your Google Sheet

Before writing any code, you need a clean sheet structure. Apps Script reads rows as arrays, so keeping your headers predictable saves you a lot of parsing headaches. Set up a new Google Sheet with these five columns in row 1:

• ID (Column A)
• Name (Column B)
• Email (Column C)
• Status (Column D)
• Webhook Sent (Column E)

Do not skip that fifth column (“Webhook Sent”). Without a status flag to mark which rows have already been sent, your script will eventually double-send payloads. Plus, it gives you a quick visual confirmation right in the sheet that the webhook actually fired.

Throw in a couple of dummy rows. Set one status to “Pending” and another to “Ready”. Leave the “Webhook Sent” column blank for now.

Writing the Apps Script Webhook Code

Head over to Extensions > Apps Script in your Google Sheet menu. This opens up the editor with a default Code.gs file. Wipe out whatever placeholder code is in there.

To make HTTP requests, we use Google’s UrlFetchApp class. It handles standard POSTs, GETs, and PUTs. We will write a function that grabs the active row, packages the cell values into a neat JSON payload, and POSTs it to our endpoint.

Here is the baseline script to get the data moving:

function sendRowWebhook() { const sheet = SpreadsheetApp.getActiveSpreadsheet().getActiveSheet(); const activeRow = sheet.getActiveCell().getRow(); // Prevent running on the header row if (activeRow === 1) { Logger.log("Cannot send webhook for header row."); return; } // Fetch columns A through E for the active row const rowData = sheet.getRange(activeRow, 1, 1, 5).getValues()[0]; const payload = { id: rowData[0], name: rowData[1], email: rowData[2], status: rowData[3], timestamp: new Date().toISOString() }; // Replace with your actual receiver URL const url = "https://your-api-endpoint.com/webhook"; const options = { method: "post", contentType: "application/json", payload: JSON.stringify(payload), muteHttpExceptions: true }; try { const response = UrlFetchApp.fetch(url, options); Logger.log("Response Code: " + response.getResponseCode()); Logger.log("Response Body: " + response.getContentText()); } catch (err) { Logger.log("Error occurred: " + err.toString()); }
}

This grabs the active row, pulls columns A through E, and maps them into a JSON payload. Notice the muteHttpExceptions: true option. If your receiving server throws a 400 or 500 error, Apps Script’s default behavior is to crash the entire execution. Setting this to true lets us capture the error and log it, which is a lifesaver for debugging.

Testing the Script Manually

Before we automate this, let’s make sure the network call actually works. Save your project (Ctrl+S or Cmd+S), select sendRowWebhook from the function dropdown at the top, and hit Run.

Since this is the first run, Google will throw an “Authorization Required” popup. Because the script is accessing your spreadsheet data and hitting an external API, you have to grant it permission. Click Review Permissions, select your Google account, hit Advanced, click Go to Untitled project (unsafe), and click Allow. Yes, Google makes you jump through hoops even for your own scripts.

To catch and inspect these payloads without spinning up a full backend server yet, you can use a temporary webhook testing site. If you want to route these payloads directly to a local development server on your machine, check out this guide on how to Test Webhooks Locally with Cloudflare Tunnels.

Once the script finishes running, check the Execution log at the bottom of the editor. You should see the exact response code and body returned by your endpoint.

Automating with Apps Script Triggers

Clicking “Run” manually is not automation. We want this to fire automatically whenever someone edits the sheet. Apps Script has two types of triggers: simple triggers and installable triggers.

A simple trigger like onEdit(e) seems perfect, but it has a massive catch: security restrictions. Simple triggers are not allowed to access services that require authentication. That means UrlFetchApp will fail silently with a permissions error if you try to run it inside a standard, unauthenticated onEdit(e) function.

To get around this, we have to use an installable trigger. These run with the explicit permissions of the user who set them up, which allows them to make external HTTP requests. Here is how to set one up:

1. In the Apps Script editor, click the clock icon (Triggers) on the left sidebar.
2. Click the + Add Trigger button in the bottom right.
3. Under “Choose which function to run”, select your webhook handler function.
4. Under “Select event source”, choose From spreadsheet.
5. Under “Select event type”, choose On edit.
6. Click Save and authorize the permissions if prompted.

If you want to dive deeper into how Google handles background events, check out the official Google Apps Script Triggers documentation.

Fixing the Trigger Loop and Filter Gotchas

Now that the trigger is live, we have a dangerous problem. If your script runs on every single edit, you will burn through your daily Google API quotas in minutes. Worse, if your script writes “SENT” back to column E, that write action is also an edit. This triggers the script again, creating an infinite loop that will quickly lock you out of your execution limits.

We need to make the script smart enough to ignore edits unless they happen on the right sheet, in the right column, and with the right value. Here is the production-ready code that handles these checks and updates the status column safely:

function handleSheetEdit(e) { // Safety check for manual runs without event objects if (!e) { Logger.log("No event object detected. Run this by editing the spreadsheet."); return; } const range = e.range; const sheet = range.getSheet(); // 1. Only run on the "Leads" sheet if (sheet.getName() !== "Leads") { return; } const row = range.getRow(); const col = range.getColumn(); // 2. Only run if the "Status" column (Column 4 / D) was edited if (col !== 4) { return; } const statusValue = range.getValue(); // 3. Only run if status is set to "Ready" if (statusValue !== "Ready") { return; } // 4. Check if we already sent a webhook for this row const statusCell = sheet.getRange(row, 5); // Column E if (statusCell.getValue() === "SENT") { Logger.log("Webhook already sent for row " + row + ". Skipping."); return; } // Fetch row details const rowData = sheet.getRange(row, 1, 1, 4).getValues()[0]; const payload = { id: rowData[0], name: rowData[1], email: rowData[2], status: rowData[3] }; const url = "https://your-api-endpoint.com/webhook"; const options = { method: "post", contentType: "application/json", payload: JSON.stringify(payload), muteHttpExceptions: true }; try { const response = UrlFetchApp.fetch(url, options); const code = response.getResponseCode(); if (code === 200 || code === 201) { // Mark as sent to prevent duplicate triggers statusCell.setValue("SENT"); Logger.log("Webhook successfully sent for row " + row); } else { Logger.log("Receiver returned status " + code + ": " + response.getContentText()); } } catch (err) { Logger.log("HTTP request failed: " + err.toString()); }
}

Go back to your installable trigger and change the target function to handleSheetEdit instead of the old manual one. This new function checks if the edit happened on the “Leads” sheet, confirms that column D (Status) was the one modified, verifies the value is “Ready”, and makes sure column E isn’t already marked as “SENT”. Only then does it fire the webhook.

If you are building more complex workflows—like sending follow-ups or notifications directly from your spreadsheet—you might also want to look at how to Automate Invoice Reminders from Google Sheets with Apps Script.

Debugging Webhook Failures in Apps Script

When webhooks fail in production, debugging is a pain because Apps Script runs in Google’s cloud, not on your local machine. If your receiving server is dropping payloads, you have to verify both sides of the connection.

Start with the Apps Script Executions dashboard (the list icon in the left menu). This shows you every single run, how long it took, and whether it succeeded or failed. If a run failed, click into it to see the exact error logs.

Here are the most common issues I run into:

• Timeout Errors (Exceeded execution time): Google limits execution times strictly (usually 6 minutes, but simple triggers can time out in 30 seconds). If your receiving server takes too long to process the payload and respond, Apps Script will kill the connection. Make sure your webhook receiver returns an immediate 200 OK and processes the data asynchronously in the background.
• Payload validation issues: If your receiver expects a strict schema and rejects the request with a 400 Bad Request, Apps Script will log this if you have muteHttpExceptions turned on. To prevent payload errors on your Node.js or Express receiver, consider implementing strict validation schemas as outlined in our guide on how to Validate Webhook Payloads with Zod in Express.
• Empty cells: If your script reads an empty row, the values in your payload array will be empty strings. Make sure your receiver knows how to handle empty fields without crashing.

Webhook Security and Payload Verification

Sending webhooks over the public internet without verification is asking for trouble. Anyone who finds your endpoint URL could spam fake data to your database. To secure this, you should sign your payloads or include a shared secret token in your request headers.

Do not hardcode your secret token directly in the script. Use Google’s Properties Service instead. It acts like an environment variable store, keeping sensitive keys out of your source code.

To add your secret token:

1. In the Apps Script editor, click the gear icon (Project Settings) on the left menu.
2. Scroll down to the Script Properties section.
3. Click Add script property.
4. Set the Property name to WEBHOOK_SECRET and paste your secure token as the Value.
5. Click Save script properties.

Now, update your request options to pull this secret and pass it in a custom header like X-Webhook-Secret. This aligns with standard HTTP practices for payload identification, which you can read about in the MDN POST request guidelines.

Here is how to modify your request options to include the secure header:

const secretToken = PropertiesService.getScriptProperties().getProperty("WEBHOOK_SECRET"); const options = { method: "post", contentType: "application/json", headers: { "X-Webhook-Secret": secretToken || "" }, payload: JSON.stringify(payload), muteHttpExceptions: true
};

On your receiving server, verify this header before processing the incoming payload. If the header is missing or doesn’t match your secret, reject the request immediately with a 401 Unauthorized response.

Webhooks from Google Sheets FAQ

Why does my script fail with “You do not have permission to call UrlFetchApp”?

This happens because you are trying to call UrlFetchApp inside a simple trigger like onEdit(e). Simple triggers run automatically without user consent, so Google restricts them from making external network calls. To fix this, delete the simple onEdit function and set up an installable trigger using the Apps Script dashboard instead.

Can I send webhooks in bulk if I update multiple rows at once?

If you paste data into multiple cells at once, the installable edit trigger only fires once for the entire range. The event object e.range will represent the entire block of edited cells rather than a single cell. If your script only checks range.getRow(), it will only process the top-left cell. To handle bulk updates, you must loop through all rows within e.range.getNumRows() and send a payload for each row.

What are the daily rate limits for sending webhooks from Apps Script?

Google imposes daily quotas on UrlFetchApp calls. Standard Google accounts (Gmail) are limited to 20,000 requests per day, while Google Workspace (enterprise) accounts can make up to 100,000 requests per day. If you expect to exceed these limits, consider batching your updates and sending them via a scheduled time-driven trigger instead of an edit trigger.

How do I handle JSON responses returned by my webhook receiver?

If your webhook receiver returns data that you need to write back to the sheet, you can parse the response body using JSON.parse(). For example:

const response = UrlFetchApp.fetch(url, options);
if (response.getResponseCode() === 200) { const responseData = JSON.parse(response.getContentText()); // Write returned ID from backend to column F sheet.getRange(row, 6).setValue(responseData.external_id);
}

Next Steps

Now that your Google Sheet is successfully dispatching webhooks on edits, you can connect it to your backend services or workflow tools. If you need to handle incoming APIs on the Google Sheets side instead of just sending them, learn How to Fetch Paginated API Data in Google Apps Script to pull external data back into your spreadsheets automatically.