Countdown timers in Make and Zapier
Both platforms can create and react to countdown deadlines today with their generic HTTP steps — no app to install. This guide covers the exact configuration for each, the idempotency detail that stops retries creating duplicate timers, and an honest note about webhook security, which is the one place these tools are weaker than code.
Why not Delay or Sleep
Both platforms have a built-in wait, and for short pauses inside a scenario they are the right tool. For a deadline measured in days they hold a queued task rather than creating anything.
| Delay / Sleep step | Countdown timer | |
|---|---|---|
| Short pause in a run | Yes | Not applicable |
| Deadline visible to a customer | No | Hosted page, embed, and email GIF |
| Move the deadline afterwards | No | PATCH the timer |
| Several reminders from one deadline | One branch each | One rule each, on the same timer |
| Inspect what is pending | Platform queue only | Query the timer at any time |
| Consumes platform tasks while waiting | Typically yes | No |
Zapier: creating a timer
Use Webhooks by Zapier → Custom Request. The built-in POST action URL-encodes the body, which the API will reject.
Zapier configuration
Zapier — Webhooks by Zapier -> Custom Request
Method: POST
URL: https://countdownshare.com/api/v1/timers
Headers:
Authorization Bearer cs_live_your_key_here
Content-Type application/json
Idempotency-Key trial_{{customer_id}}
Data (raw JSON — switch the Data Pass-Through toggle OFF
and paste into the Data field):
{
"name": "Trial for {{email}}",
"type": "personalized",
"duration_seconds": 1209600,
"external_user_id": "{{customer_id}}",
"publish": true
}Make: creating a timer
The HTTP → Make a request module, with Body type set to Raw and content type JSON.
Make configuration
Make — HTTP -> Make a request
URL: https://countdownshare.com/api/v1/timers
Method: POST
Body type: Raw
Content type: JSON (application/json)
Parse response: Yes
Headers:
Authorization Bearer cs_live_your_key_here
Idempotency-Key trial_{{1.customer_id}}
Request content:
{
"name": "Trial for {{1.email}}",
"type": "personalized",
"duration_seconds": 1209600,
"external_user_id": "{{1.customer_id}}",
"publish": true
}Turn on Parse response so later modules can reference data.id as a mapped field rather than a raw string.
The detail that prevents duplicates
Both platforms retry failed steps automatically. Without a stable Idempotency-Key, a retry creates a second timer — and on a fourteen-day trial that means someone quietly gets twenty-eight days.
Derive the key from the record, not from anything that changes between attempts:
Works
trial_{{customer_id}}order_{{order_id}}_holdinvite_{{invitation_id}}
Defeats the mechanism
{{zap_meta_human_now}}— changes on every attempt- A random string generated in the step
- A single constant reused for every timer
idempotency_conflict instead of being created. That failure is at least loud — unlike the timestamp version, which silently creates duplicates. Idempotency has the full reasoning.Reacting when the deadline passes
Create a second scenario or Zap starting with a Custom Webhook (Make) or Catch Hook (Zapier). Register that URL once as a webhook destination, then attach rules to your timers.
Attaching the rule
Second HTTP module/action — attach the rule.
Method: POST
URL: https://countdownshare.com/api/v1/timers/{{data.id}}/webhook-rules
Data:
{
"name": "Trial ended",
"webhook_destination_id": "your-destination-id",
"condition": { "field": "status", "operator": "equals", "value": "ended" },
"delivery": "once"
}
Register the destination once, by hand, pointing at the Catch
Hook / Custom Webhook URL from the receiving scenario. Reuse
its ID everywhere.The delivery arrives with timer, rule, and data objects. Branch on rule.name so one webhook can serve a reminder ladder and an expiry from the same scenario.
The security caveat, stated plainly
Neither platform makes HMAC verification straightforward — Zapier needs a Code step, and Make needs comparable effort. In practice most automation users skip it, which means the webhook URL is the only secret protecting the workflow.
That is acceptable for sending a reminder email and not acceptable for cancelling an order or issuing a refund. If the action is destructive, put the endpoint in something that can verify the signature properly — see the n8n guide, which can, or any of the backend guides.
Putting the countdown in an email step
If the scenario sends mail through Mailchimp, Klaviyo, or Gmail, fetch the outputs and map the GIF into the HTML body.
Fetching the email GIF
Getting the email GIF for a Mailchimp or Klaviyo step:
Method: GET
URL: https://countdownshare.com/api/v1/timers/{{data.id}}/outputs
Then map data.email_embed_html into the HTML body of your
email action. It renders the recipient's own remaining time
when they open the message, not when you sent it.Paired with a personalized timer, each recipient sees their own remaining time rendered at the moment they open the message — which is the thing a Delay step cannot do at all. See embeds and hosted pages.
Common questions
Is there an official Zapier or Make app?
Not currently. Both platforms handle this well through their generic HTTP steps — Webhooks by Zapier and the HTTP module in Make — because the API is plain REST with bearer auth. Everything on this page works today with no app to install.
Why not use the Zapier Delay step?
Delay is fine for short waits. For longer ones it holds a task in a queue rather than creating anything you can see or change, so there is no countdown to show a customer, no way to move the deadline, and no record to inspect. It also consumes a task in your plan for every held item.
Why do I get duplicate timers?
Almost always a missing or non-stable Idempotency-Key. Both platforms retry failed steps, and a retry without a stable key creates a second timer. Derive the key from the record — trial_{{customer_id}} — never from a random value or a timestamp.
Can I verify the webhook signature in Zapier or Make?
Not easily, and generally not at all in Zapier without a Code step. Treat the webhook URL as a secret, keep the actions it triggers non-destructive, and do anything sensitive in a system that can verify properly. Both platforms give you long, unguessable URLs, which is meaningful but weaker than an HMAC check.
Next steps
No app to install
The generic HTTP steps in both platforms are enough. Sandbox is free with any account — build the scenario against a test key first.