---
title: "Make"
description: "Use the EveryPage app in Make scenarios to upload PDFs, manage share settings, and react to reader events."
canonical: "https://everypage.co/docs/integrations/make"
plan: "free"
last-updated: "2026-08-18"
---

# Make

The EveryPage Make app provides modules for uploading PDFs, managing share settings and link variants, pulling readership data, and starting scenarios from reader events.

## Access

The app is deployed and usable but **not publicly listed in Make's app directory** — searching Make for "EveryPage" will not find it. Access is by invite link: sign in to EveryPage, open your **Account** page, and use the Make early-access link in the banner above your API keys. Opening that link installs the app into your Make organisation, where it becomes available in the module picker.

## Authentication

You need an EveryPage API key to connect. Navigate to **Account** > **API keys** on everypage.co and copy an `ep_live_` key. Paste it into the Make connection panel; it will be sent as a bearer token on all requests. The connection is validated immediately against the current-user endpoint and labeled with your email and plan tier.

For details on API keys and rotation, see [API keys](https://everypage.co/docs/developers/api-keys).

## Instant triggers

These webhooks fire in real time when events occur on your documents. EveryPage automatically registers and removes the webhook URL when you add or delete the trigger from your scenario.

| Module | Event | Plan |
| --- | --- | --- |
| Watch reads | `file.viewed` — a reader finishes a viewing session. Includes pages viewed and time spent. | All plans |
| Watch downloads | `file.downloaded` — a reader (not you) saves the PDF to disk. | All plans |
| Watch form fills | `gate.completed` — a viewer completes the email gate or lead form, with the captured fields. | Pro |
| Watch comments | `note.created` — a reader leaves a comment on a page, with the comment text and the page it was left on. | All plans |

EveryPage webhooks are available on every plan. The only plan requirement is on `gate.completed`: **Watch form fills** registers successfully on Free and Basic, but the server never delivers those events, so the trigger never fires. Note also that Make cannot verify delivery signatures — see [Webhook signature verification](https://everypage.co/docs/integrations/make#webhook-signature-verification) below.

These four are the only instant triggers Make offers. The `receipt.confirmed`, `file.burned`, `content.replaced`, `invite.viewed`, and `proofing.updated` kinds are available through the [API](https://everypage.co/docs/developers/webhooks) and the n8n node, but have no Make module yet.

**Watch comments** only fires for comments a reader can leave publicly. If you switch a document's comments to private, every comment becomes private and no `note.created` event is emitted at all — by design, so private feedback never leaves the document.

## Polling trigger

**Watch events** walks the EveryPage event feed (`GET /api/v1/events`) using an event-ID cursor, not a timestamp: each cycle asks for events with an ID above the highest one already seen. You choose the event type (read, download, or form fill), optionally scope it to one document, and set how many events to process per cycle (default 10; the rest stay queued for the next cycle).

Cursors are per event type, so changing the type re-baselines the trigger — run one scenario per event type rather than switching. Because Make charges per operation, the module's own guidance is a 15-minute schedule.

See [Events feed](https://everypage.co/docs/developers/events-feed) for cursor semantics and payload structure.

## Modules

### File operations

| Module | What it does | Plan |
| --- | --- | --- |
| Upload a file | Multipart PDF upload with optional settings (file name, viewer mode, passcode, expiry or never-expire, protection toggles, view limit, receipt request, email gate and domain allowlist, page range, watermark, vanity slug). Outputs the share link, QR code URL, and embed code. | All plans; individual settings are tiered |
| Update file settings | Modify sharing settings on an existing document. Only the fields you fill in are sent; the rest keep their current values. Re-fetches the document afterwards so the returned links and QR code reflect the live state. | All plans; individual settings are tiered |
| Get a file | Fetch a single document's metadata and sharing settings by UUID or short ID. | All plans |
| List files | List your documents newest first, optionally filtered by file name (case-insensitive substring). The upstream list is unpaginated, so the name filter and limit are applied by Make. | All plans |
| Delete a file | Moves the document to trash by default. Turn on **Permanently delete (purge)** to destroy it instead — that cannot be undone. | All plans |
| Replace file content | Swap the PDF bytes of an existing document while keeping the link, QR code, settings, and readership history intact. Page-anchored hotspots and notes are cleared by default; keep them only when the new PDF has the same page layout. Re-fetches the document afterwards. | Pro |
| Get a QR code | Fetch the QR code as a PNG (binary data, default file name `qr-code.png`). | All plans |
| Get a readership summary | Retrieve a document's readership rollup: views, sessions, unique visitors, countries, downloads, time-on-page, and completion. Sections above your plan tier are omitted; the `tier` output says which tier the report was built at. | All plans |
| Get page marks | Retrieve the pick, reject and maybe verdicts readers left on the document's pages, as per-page tallies, a per-viewer breakdown and totals. | Pro |
| Get annotations | Retrieve the annotations readers drew on the document, grouped by page, with each reader's note. | Pro |

Proofing feedback is a pull, not a push: the `proofing.updated` event fires once per viewer, on their first mark, and carries no verdicts. Trigger on it (or on a new comment) and then read the marks. See [page marks](https://everypage.co/docs/reader-interaction/page-marks) and the [photo proofing automation guide](https://everypage.co/guides/photo-proofing-automation).

### Link variants (Pro only)

Variants are per-recipient child links off one document: each gets its own short link and an optional recipient label, so readership attributes to the individual you sent it to. Overrides are limited to download permission and page range — per-variant passcodes and email gates are not supported; those settings live on the parent document and apply to every variant.

| Module | What it does |
| --- | --- |
| Create a link variant | Mint a per-recipient link, with an optional label and optional `allowDownload` / page-range overrides. Returns the variant UUID, short ID, and URL. |
| List link variants | Fetch all variants of a document. |
| Update a link variant | Change a variant's label, revoked state, or overrides. **Setting any override field replaces the whole overrides object**, it never merges — re-state every override you want to keep. |
| Revoke a link variant | Stop a variant's URL from resolving without deleting it. Revoked links return a uniform 404, not a 410 — a revoked recipient must not learn the canonical link exists. Set **Revoked** to No on Update to reverse it. |
| Delete a link variant | Removes the variant. With **GDPR-redact the recipient label** turned on it does the opposite: the variant is *not* removed, its label is erased in place and its readership rows are anonymised. The `deleted` and `redacted` outputs say which happened. |

### Event and data operations

| Module | What it does |
| --- | --- |
| List events | Bulk query one event stream (read, download, or form fill), optionally scoped to a document, with a `since` event-ID cursor. One run makes one request, capped at the API's 100 events; to go further, feed the highest ID seen back into **Since** on the next run. Cursors are per event type and never portable between types. Gate event IDs are 64-bit—map them through as text, unmodified. |
| Make an API call | Direct access to any EveryPage API endpoint. Use it for endpoints with no dedicated module. |

## Output contract

Every file-producing module returns three standard fields:

- **Share link** (`shareUrl`): `https://everypage.co/{shortId}` (or UUID if no short ID exists)
- **QR code URL** (`qr_url`): `https://everypage.co/api/files/{uuid}/qr-code` (always UUID-keyed and public)
- **Embed code** (`embed_code`): `<iframe>` snippet for embedding on web pages (uses the `/embed/` path)

Upload also returns `uuid`, `shortId`, and `fileName` (the display name you set, or `document.pdf` if you left it blank). Settings updates and content replacement re-fetch the document afterwards, so the returned links reflect the post-update state.

Share links and embed codes never use a vanity slug. Slugs are renameable and resolve only on a custom domain, so module outputs — which end up in emails, CRM notes, and printed QR codes — always use the short ID or UUID.

## Limitations and notes

### Webhook signature verification

EveryPage signs every webhook delivery with HMAC-SHA256 (`X-Everypage-Signature`), but **the Make app cannot verify that signature**. Make's integration language has no cryptographic primitives, and webhook bodies arrive already parsed rather than as raw bytes, so there is nothing to compute an HMAC over. Authenticity therefore rests entirely on the unguessable webhook URL Make generates for each trigger — treat that URL as a secret and do not share or publish it.

The Zapier app and the n8n node do verify signatures; n8n additionally fails closed, rejecting any unverified delivery. If signature verification matters to your threat model, use one of those. See [webhooks](https://everypage.co/docs/developers/webhooks) for the signature specification.

### No import-from-URL module

The API's `/files/import` endpoint is host-allowlisted, so there is no Make module that imports a PDF straight from a URL. The Make-native pattern is **HTTP > Get a file → EveryPage > Upload a file**: fetch the bytes with Make's own HTTP module, then map them into the upload module's PDF file field.

### Re-fetching on update

When you update file settings or replace content, Make automatically re-fetches the document to return accurate share URLs and QR codes. This adds a second API call per operation but ensures outputs match the live state.

## Related

- [API keys](https://everypage.co/docs/developers/api-keys)
- [Webhooks](https://everypage.co/docs/developers/webhooks)
- [Events feed](https://everypage.co/docs/developers/events-feed)
- [Link variants](https://everypage.co/docs/sharing/link-variants)
- [Plans and limits](https://everypage.co/docs/getting-started/plans-and-limits)
