Send form submissions to your own API

What lands in Webhooks

• A JSON POST with the submission, form metadata and spam verdict
• An HMAC-SHA256 signature header computed over the raw body
• A timestamp header so you can reject replayed requests
• Automatic retries with exponential backoff across several attempts
• A delivery log with request, response and one-click replay

Setup

1. 1

   Add a webhook destination

   Point it at an HTTPS URL you control and copy the signing secret the dashboard generates.

2. 2

   Verify the signature

   Compute HMAC-SHA256 over the raw request body using your secret and compare it to the signature header with a constant-time comparison.

3. 3

   Return 2xx quickly

   Acknowledge fast and do slow work asynchronously. Non-2xx responses and timeouts are retried with backoff.

Webhooks example

Swap in your own endpoint and these run as-is.

{
  "id": "sub_2f9x...",
  "formId": "frm_8a1c...",
  "createdAt": "2026-03-04T10:12:44.019Z",
  "data": {
    "name": "Ada Lovelace",
    "email": "ada@example.com",
    "message": "Do you support file uploads?"
  },
  "files": [],
  "meta": {
    "ip": "203.0.113.42",
    "country": "GB",
    "referrer": "https://example.com/pricing",
    "userAgent": "Mozilla/5.0 ..."
  },
  "spam": { "score": 0.02, "quarantined": false }
}

import { createHmac, timingSafeEqual } from "node:crypto";

export function verify(rawBody: string, headers: Headers): boolean {
  const signature = headers.get("x-webforms-signature") ?? "";
  const timestamp = headers.get("x-webforms-timestamp") ?? "";

  // Reject anything older than five minutes to blunt replay attacks.
  if (Math.abs(Date.now() - Number(timestamp)) > 5 * 60 * 1000) return false;

  const expected = createHmac("sha256", process.env.WEBFORMS_SECRET!)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex");

  const a = Buffer.from(expected);
  const b = Buffer.from(signature);
  return a.length === b.length && timingSafeEqual(a, b);
}

Worth knowing

• Always verify against the raw request body. Parsing and re-serialising the JSON changes the bytes and the signature will never match.
• Compare signatures with a constant-time function. A plain === leaks timing information.
• Your endpoint should be idempotent: a retry after a timeout can deliver the same submission twice, and the submission id is stable across attempts.

Webhooks form FAQ

Other destinations

• Zapier, Make and n8nCatch hooks, build anything
• EmailStraight to any inbox
• SlackRich blocks in a channel
• NotionRows in a database