Integrations

Connect PigeonFiles to ChatGPT, Claude, or Gemini

Connect a supported AI assistant through PigeonFiles’ remote MCP server. Authorize the workspace and permissions it needs, then ask it to inspect records or help create and update an upload page. Workspace Integrations settings with connected apps and API tokens. What you can ask your AI to do You can ask your AI assistant to create an upload page, add or change questions, choose from storage folders you have already connected, update page settings, and publish the page when it is ready. It can also list your upload pages and review submission records when you give it permission. The connection uses Model Context Protocol (MCP), a standard that lets an AI assistant work with tools in another app. PigeonFiles asks you to sign in, choose a workspace, and approve what the AI is allowed to do. Check that your AI product supports the connection Check your AI product’s current support for remote MCP, OAuth, and tools that change data. A connection that only supports reading cannot create or publish pages. Your workspace administrator may also need to allow custom connections. Use the current setup instructions for ChatGPT, Claude, or Gemini CLI. Product plans and connection settings can change. Steps 1. Open your AI assistant. Open ChatGPT, Claude, Gemini, or another supported AI product. 2. Add a connection. Look for connections, connectors, tools, or MCP servers in the AI product's settings. Add a remote server or custom connector. 3. Name the server. Enter PigeonFiles as the server name. 4. Enter the server URL. Paste the PigeonFiles MCP server URL: https://app.pigeonfiles.com/api/mcp 5. Choose OAuth authentication. If the client asks for an authentication method, select OAuth. 6. Authorize PigeonFiles. The client opens a PigeonFiles authorization flow. Sign in with your PigeonFiles account. 7. Choose a workspace. Select which workspace the AI client can access. Each connection is scoped to one workspace. 8. Approve scopes. Review and approve the tool permissions the client is requesting. Only approved scopes will be available to the client. 9. Confirm the connection. After authorization completes, the AI client can list and call PigeonFiles tools for the selected workspace. Available tools Once connected, the AI client can use these tools: Tool What it does pigeonfiles_get_workspace_summary Read workspace overview and settings pigeonfiles_list_upload_pages List all upload pages in the workspace pigeonfiles_get_upload_page Read a specific upload page's configuration pigeonfiles_get_upload_page_embed_code Get iframe embed code for an upload page. JavaScript embed code requires an explicit confirmation flag and enabled allowed origins. pigeonfiles_create_upload_page Create a new upload page pigeonfiles_update_upload_page Update an existing upload page pigeonfiles_publish_upload_page Publish a draft upload page pigeonfiles_list_submissions List submissions for an upload page pigeonfiles_get_submission Read a specific submission's details pigeonfiles_export_submissions_csv Export submission data as CSV pigeonfiles_list_storage_connections List connected storage accounts pigeonfiles_get_storage_connection Read a storage connection's details pigeonfiles_list_webhooks List webhook endpoints pigeonfiles_get_webhook Read a webhook endpoint's configuration pigeonfiles_get_submission_created_sample Get a sample submission.created webhook payload pigeonfiles_get_upload_page_automation_schema Read the automation configuration schema for an upload page The client can only use tools that match the scopes you approved during authorization. Troubleshooting Client cannot list tools. Disconnect and reconnect the server. Confirm that the OAuth authorization flow completed and you approved the requested scopes. A specific tool is missing. The authorization grant may not include the scope for that tool. Revoke the connection and reconnect, approving the additional scope. Tools return errors about the wrong workspace. Each connection is scoped to one workspace. If you need to access a different workspace, revoke the current grant and reconnect, choosing the correct workspace during authorization. Client does not support remote MCP. Some AI clients only support local/stdio MCP servers. If your client does not have a "remote server" or "custom connector" option, it cannot connect to PigeonFiles through this method. Check your client's documentation for remote MCP support. Publish fails. If pigeonfiles_publish_upload_page returns an error, the upload page may not be ready for publishing. Inspect the readiness output for missing fields, destinations, or configuration issues. Next steps - Create API token, access workspace data from scripts and custom integrations. - Automations and integrations. Frequently asked questions Can I connect ChatGPT, Claude, or Gemini? Yes, when the version and plan you use support remote MCP servers or custom connectors. The name of this setting varies between AI products, so check the current instructions for your AI assistant. What can the AI client do? The tool set includes reading workspace summaries, listing and managing upload pages, retrieving upload page embed code, reading and exporting submissions, inspecting storage connections and webhooks, and retrieving sample webhook payloads. The client can only use tools that match the scopes you approve during authorization. Can the AI client access my uploaded files? The MCP tools expose workspace data such as metadata, submission records, and upload page configuration. They do not stream raw file contents through the MCP server. File access still depends on the links and permissions in your connected storage.

Connect Make

Create a Make scenario that turns a submission into a record, task, or message in another service. Start in Make; PigeonFiles lists the connected subscription after setup. What the Make connection does When someone submits files through a PigeonFiles upload page, the submission event can trigger a scenario in Make. The scenario receives the submission data, uploader details, field answers, file metadata, and destination information, and passes it through whatever modules you configure. This lets operations teams connect file intake to downstream tools through Make without writing code. Common examples include creating a task in a project tool through Make, updating a CRM record through Make, or sending a notification to a team channel through Make. Pro or Agency is required. You also need access to the integration in the automation service. If PigeonFiles does not appear in that service’s app list, contact support for its current availability before building the workflow. Steps 1. Start in Make. Log in to your Make account and create a new scenario. 2. Add a PigeonFiles trigger module. Search for PigeonFiles in the module list and add it as the trigger. 3. Select the trigger event. Choose the submission event type you want to trigger on. 4. Connect your PigeonFiles account. Make opens a PigeonFiles authorization flow. Sign in and authorize Make to access your workspace. 5. Choose the upload page. Select which upload page this scenario should listen to. Each scenario subscribes to one upload page. PigeonFiles Automation > Make panel, where connected subscriptions are listed. 6. Test the trigger. Run the scenario once to pull a sample event. If no sample is available, submit a test upload through the upload page first, then run the scenario to pick up the event. 7. Add action modules. Configure the downstream modules and field mappings. You can map uploader name, email, field answers, file names, file links, and other submission data into each module's inputs. 8. Activate the scenario. Turn on the scenario so it runs on every new submission event for that upload page. What data is available The PigeonFiles trigger module provides submission data you can map into downstream modules: - Uploader name and email (if collected on the upload page). - Field answers from the upload page's metadata fields. - File names, sizes, types, and destination details. - Submission timestamp and upload page context. - AI extraction values (if AI processing is configured on the upload page). Viewing connected scenarios in PigeonFiles After creating a scenario, the subscription appears in the PigeonFiles upload page editor under Automation > Make. Connected scenarios show as read-only entries with their status (Enabled or Disabled) and subscribed events. You manage the scenario itself from Make, not from PigeonFiles. Troubleshooting Scenario not running. Check that the scenario is activated in Make and that the PigeonFiles authorization is still valid. Submit a test upload and check the scenario's execution history in Make. Missing fields in downstream modules. If you added new fields to the upload page after creating the scenario, re-map the trigger module in Make so the new fields appear. Authorization expired. Reconnect PigeonFiles in Make's connection settings. The scenario will resume receiving events after reauthorization. Duplicate runs. If a scenario runs twice for the same submission, check whether you have multiple scenarios listening to the same upload page, or whether Make's scheduling processed a retry. Next steps - Connect Zapier, an alternative no-code automation platform. - Automations and integrations. - Send submissions to Google Sheets, log submissions as spreadsheet rows without Make. Frequently asked questions Does PigeonFiles send the actual uploaded files to Make? No. PigeonFiles sends submission metadata, uploader details, field answers, file names, file sizes, destination paths, and file links. Use the file links to access files from your connected storage. Can I trigger scenarios from specific upload pages only? Yes. When you set up the PigeonFiles trigger in Make, you select which upload page the scenario subscribes to. Each scenario subscribes to one upload page. Where can I see connected scenarios? In the PigeonFiles upload page editor, open the Automation section. Connected Make subscriptions appear as read-only entries showing their status and subscribed events.

Connect Zapier

Create a Zap that turns a submission into a record, task, or message in another service. Start in Zapier; PigeonFiles lists the connected subscription after setup. What the Zapier connection does When someone submits files through a PigeonFiles upload page, the submission event can trigger a Zap in Zapier. The Zap receives the submission data, uploader details, field answers, file metadata, and destination information, and passes it to whatever action steps you configure. This lets non-technical teams connect file intake to downstream tools through Zapier without writing code. Common examples include logging uploads in a project tracker, sending a notification to a team channel through Zapier, or creating a record in a CRM through Zapier. Pro or Agency is required. You also need access to the integration in the automation service. If PigeonFiles does not appear in that service’s app list, contact support for its current availability before building the workflow. Steps 1. Start in Zapier. Log in to your Zapier account and create a new Zap. 2. Choose PigeonFiles as the trigger app. Search for PigeonFiles in the trigger app list. 3. Select the trigger event. Choose the submission event type you want to trigger on. 4. Connect your PigeonFiles account. Zapier opens a PigeonFiles authorization flow. Sign in and authorize Zapier to access your workspace. 5. Choose the upload page. Select which upload page this Zap should listen to. Each Zap subscribes to one upload page. PigeonFiles Automation > Zapier panel, where connected subscriptions are listed. 6. Test the trigger. Zapier pulls a sample event from PigeonFiles so you can see the available data fields. If no sample is available, submit a test upload through the upload page first. 7. Add action steps. Configure the action apps and field mappings for your Zap. You can map uploader name, email, field answers, file names, file links, and other submission data into the action step's fields. 8. Turn on the Zap. Publish the Zap so it runs on every new submission for that upload page. What data is available The PigeonFiles trigger provides submission data you can map into Zap action steps: - Uploader name and email (if collected on the upload page). - Field answers from the upload page's metadata fields. - File names, sizes, types, and destination details. - Submission timestamp and upload page context. - AI extraction values (if AI processing is configured on the upload page). Viewing connected Zaps in PigeonFiles After creating a Zap, the subscription appears in the PigeonFiles upload page editor under Automation > Zapier. Connected Zaps show as read-only entries with their status (Enabled or Disabled) and subscribed events. You manage the Zap itself from Zapier, not from PigeonFiles. Troubleshooting Zap not triggering. Check that the Zap is turned on in Zapier and that the PigeonFiles authorization is still valid. Submit a test upload through the upload page and check the Zap's task history in Zapier. Missing fields in the action step. If you added new fields to the upload page after creating the Zap, update the trigger's sample data in Zapier so the new fields appear in the field mapper. Authorization expired. Reconnect PigeonFiles in Zapier's connected accounts settings. The Zap will resume receiving events after reauthorization. Duplicate events. If your Zap runs twice for the same submission, check whether you have multiple Zaps listening to the same upload page. Next steps - Connect Make, an alternative no-code automation platform. - Automations and integrations. - Send submissions to Google Sheets, log submissions as spreadsheet rows without Zapier. Frequently asked questions Does PigeonFiles send the actual uploaded files to Zapier? No. PigeonFiles sends submission metadata, uploader details, field answers, file names, file sizes, destination paths, and file links. Use the file links to access files from your connected storage. Can I trigger Zaps from specific upload pages only? Yes. When you set up the PigeonFiles trigger in Zapier, you select which upload page the Zap subscribes to. Each Zap subscribes to one upload page. Where can I see connected Zaps? In the PigeonFiles upload page editor, open the Automation section. Connected Zapier subscriptions appear as read-only entries showing their status and subscribed events.

Create a webhook endpoint

Create an endpoint in workspace settings, then attach it to an upload page to receive signed submission events at your server. What webhooks do When a submission is ready for downstream automation, PigeonFiles sends an HTTP POST request to your endpoint with a JSON payload describing the event. Webhooks let your team connect file intake to internal systems, custom dashboards, or processing pipelines without polling the API. Steps 1. Open Integrations. In your PigeonFiles workspace, go to Settings > Integrations. 2. Find the Webhooks section. Scroll to the Webhooks card. 3. Create the endpoint. Click Create endpoint. Create webhook endpoint dialog with Endpoint URL, Description, and the Submission created event. 4. Enter the endpoint URL. Paste your server's HTTPS URL in the Endpoint URL field. PigeonFiles sends POST requests to this URL when matching events happen. 5. Add a description (optional). Use the Description field to note what this endpoint does, like "CRM intake sync" or "Document processing queue." 6. Keep Submission created selected. The current supported event is submission.created, sent when the submission is ready for downstream automation. Failed-upload and connection-health events are not currently selectable. 7. Choose page associations separately if needed. Endpoint creation does not include an upload-page filter. To attach an endpoint to a page, open that page’s Automation > Webhooks settings. Review the selected pages before testing. 8. Save the endpoint. Click Create endpoint. 9. Copy the signing secret. PigeonFiles shows the signing secret once. Copy it and store it securely, you will use it to verify webhook signatures. The secret will not be shown again after you close this dialog. Test the endpoint After creating the endpoint, click Send test event to send a sample payload to your URL. Check that your server received the request and responded with a 2xx status code. If the test fails, check your endpoint URL, server logs, and firewall rules. Manage endpoints Enable or disable. Use Pause endpoint to stop delivery without deleting the endpoint. Use Activate endpoint to resume. Delivery status. Each endpoint shows its current status and latest delivery result. Statuses include Enabled, Disabled, Queued, Retrying, Delivered, and Failed. Recent deliveries show the attempt count. Rotate the signing secret. If a signing secret is compromised, click Rotate signing secret. Copy the new secret immediately, it will not be shown again. Update your server to verify with the new secret. Delete an endpoint. Click Delete endpoint to permanently remove it. Delivery stops for that endpoint after deletion. The endpoint delivery view with request status filters and delivery counts. Troubleshooting Deliveries show "Retrying." Your server returned a non-2xx response or the request timed out. Check your server logs and confirm the endpoint is accessible. No deliveries appearing. Verify the endpoint is enabled, the event types match the events your upload pages produce, and the endpoint is associated with the upload page you expect. Endpoint URL rejected. PigeonFiles requires HTTPS endpoints. HTTP URLs are not accepted. Next steps - Verify webhook signatures, validate that webhook requests come from PigeonFiles. - Create API token, access submission data through the API. - Automations and integrations. Frequently asked questions Do webhook payloads include the actual uploaded files? No. Webhook payloads include submission metadata, field answers, file details (name, size, type, destination path), and delivery status. The files themselves go to your connected storage. Use the file links in the payload to access them. What happens if my endpoint is down? PigeonFiles retries failed deliveries. You can see delivery status and attempt count for each endpoint in Settings > Integrations. Design your endpoint to handle duplicate deliveries safely. Where do I select upload pages? Create the endpoint in Settings > Integrations, then open an upload page’s Automation > Webhooks section to manage its endpoint associations.

Create an API token

Create a scoped API token for a script or service that needs to read your workspace data. Choose the permissions and expiration before creating it. What API tokens do API tokens give external scripts and tools scoped access to your PigeonFiles workspace. Each token is limited to specific permissions, so you control exactly what data the token can reach. API access requires Pro or Agency and permission to manage workspace integrations. Tokens are useful for building internal dashboards, syncing submission records to other systems, exporting data for reporting, or integrating PigeonFiles into a larger operational workflow. Steps 1. Open Integrations. In your PigeonFiles workspace, go to Settings > Integrations. 2. Find the API Tokens section. Scroll to the API Tokens card. 3. Start token creation. Click Create token. Create a token dialog with token name, expiration, and permission scopes. No secret is shown. 4. Name the token and choose an expiration. Enter a descriptive Token name so you can identify its consumer later. Under Expiration, choose Never, 30 days, 90 days, 1 year, or a custom date. Prefer a limited lifetime that suits the integration. 5. Select permissions. Choose the scopes this token should have access to: Scope What it allows upload_pages:read Read upload page configuration and published metadata submissions:read Read submission records and delivery outcomes submissions:export Export submission datasets for downstream systems organization:read Read workspace branding and summary settings domains:read Inspect custom domain verification and routing state connections:read Inspect available workspace storage connections notifications:read Inspect workspace notification rules and status webhooks:read Inspect webhook endpoints and delivery state Select only the scopes your integration needs. You can always create additional tokens with different scopes for different tools. 6. Create the token. Click Create token. 7. Copy the token immediately. PigeonFiles shows the full token once. Copy it now and store it securely, in a secrets manager, environment variable, or encrypted configuration file. The token will not be shown again after you close this dialog. Using the token Include the token in the Authorization header of your HTTP requests: Authorization: Bearer pf_token_... The token grants access to the workspace data matching its scopes. If a request targets data outside the token's scopes, the API returns an authorization error. Token security Store tokens securely. Treat API tokens like passwords. Do not commit them to version control, paste them in chat messages, or include them in client-side code. Use narrow scopes. Create tokens with only the permissions your integration needs. A reporting script that reads submissions does not need connections:read or webhooks:read. Rotate tokens periodically. If a token may have been exposed, revoke it immediately and create a replacement. Revoke unused tokens. When an integration is retired or a team member who created a token leaves, revoke the token from Settings > Integrations. Troubleshooting "Unauthorized" response. Check that the token is in the Authorization header with the Bearer prefix, and that it has not expired or been revoked. "Forbidden" response. Check the required scope, workspace, and current plan access. If you need a different scope, create a replacement token and update the intended integration. Token lost. Tokens cannot be retrieved after creation. Revoke the lost token and create a new one with the same scopes. Next steps - Create a webhook endpoint, receive real-time events instead of polling the API. - Automations and integrations. - Connect an AI client with MCP, connect AI tools to your workspace through the MCP server. Frequently asked questions Can I see the token again after creating it? No. The full token is shown once when you create it. Copy it immediately and store it securely. If you lose it, revoke the old token and create a new one. What can I do with an API token? Depending on the scopes you select, you can read upload page configurations, read submission records, export submissions as CSV, inspect storage connections, inspect notification rules, and inspect webhook endpoints. The API token scopes exposed in the workspace UI are read/export oriented. How do I remove a token? Go to Settings > Integrations, find the token in the API Tokens section, and revoke it. Any scripts or integrations using that token will immediately lose access.

Verify webhook signatures

Verify each webhook signature before processing the payload. PigeonFiles signs the timestamp and raw request body with the endpoint’s secret. Webhook endpoint setup. Store the one-time signing secret securely after creation. How PigeonFiles signs webhooks Every webhook delivery includes these headers: - x-pigeonfiles-signature: contains a timestamp and HMAC-SHA256 signature. - x-pigeonfiles-delivery-id: a unique identifier for this delivery. - x-pigeonfiles-event: the event type (e.g., submission.created). The signature header has the format: t=1750550400,v1=5d3a...c9f2 - t is the Unix timestamp (seconds) when PigeonFiles generated the signature. - v1 is the hex-encoded HMAC-SHA256 digest. Verification steps To verify a webhook delivery: 1. Extract the timestamp and signature. Parse the x-pigeonfiles-signature header. Split on , to get the t= and v1= components. 2. Build the signed payload. Concatenate the timestamp, a literal ., and the raw request body: {timestamp}.{raw_body} 3. Compute the expected signature. Use your signing secret to compute an HMAC-SHA256 digest of the signed payload. 4. Compare. Use a constant-time comparison to check your computed signature against the v1 value from the header. If they match, the request is genuine and unmodified. 5. Check the timestamp (recommended). Compare the t value against the current time. Reject requests where the timestamp is too old (for example, more than five minutes) to guard against replay attacks. Handling retries and duplicates PigeonFiles retries failed deliveries. Your endpoint may receive the same event more than once. To handle duplicates safely: - Use the x-pigeonfiles-delivery-id header to identify repeated deliveries of the same event. - Design your processing to be idempotent, producing the same result whether the event is processed once or multiple times. - Return a 2xx response quickly. If your processing takes time, acknowledge the request first and process the event asynchronously. Rotating the signing secret If a signing secret is compromised or you want to rotate it as a precaution: 1. Go to Settings > Integrations and open the webhook endpoint. 2. Click Rotate signing secret. 3. Copy the new secret immediately, it will not be shown again. 4. Update your server to verify with the new secret. If your endpoint may still receive in-flight retries signed before rotation, keep the change coordinated with your deployment so valid requests are not rejected during the switch. Troubleshooting Signature mismatch. Confirm you are using the raw request body (not a parsed/re-serialized version). JSON parsing and re-encoding can change whitespace or key order, which changes the digest. Timestamp too old. If your server clock is significantly different from UTC, the timestamp check may reject valid requests. Synchronize your server clock with NTP. Wrong signing secret. If you rotated the secret, make sure your server is using the current secret. The previous secret is not recoverable from PigeonFiles. Next steps - Create a webhook endpoint, set up your first endpoint if you haven't already. - Create API token, access submission data directly through the API. Frequently asked questions What happens if I don't verify signatures? Your endpoint would accept any POST request that matches the URL, including forged requests. Signature verification confirms that the request came from PigeonFiles and the payload was not modified in transit. Can I rotate the signing secret? Yes. In Settings > Integrations, open the webhook endpoint and click Rotate signing secret. Copy the new secret immediately, it will not be shown again. Update your server to verify with the new secret before the next delivery.