A Zap needs an endpoint in your app that understands the data it sends. The endpoint must validate the request before saving or acting on it.
Ask the builder for a narrow receiving endpoint: the expected fields, a shared secret or supported signature check, and a stable event ID so a retry does not create the same record twice. Decide which table it may write and keep unrelated data out of its reach.
Store the secret in Env Vars, marked secret. Configure the matching credential in the Zap's request; do not put it in the builder chat or in a public page.
Publish the endpoint before pointing the Zap at the live address. Configure Zapier's webhook action using the exact URL, method, headers and fields your endpoint expects, then send one test. Check both the Zap result and the record in your app. Repeat the same event to verify duplicate handling.
Incoming delivery and storage are separate from any paid actions the endpoint runs. Builder changes use credits, and your Zapier plan and any provider actions have their own costs.
A public endpoint is reachable by strangers too. An obscure URL alone is not authentication.