Webhooks

​

What are Webhooks?

• Real-time — Data is sent immediately when a submission is received
• Flexible — Works with any service that accepts HTTP POST requests
• Secure — Verify requests using HMAC-SHA256 signatures
• Retries — Automatic retries if your endpoint fails

​

Setting Up a Webhook

​

Payload Format

{
  "event": "form.submitted",
  "timestamp": "2025-03-07T12:00:00.000Z",
  "form_id": "abc123",
  "form_name": "Contact Form",
  "submission_id": "sub_xyz789",
  "data": {
    "email": "[email protected]",
    "name": "Jane Doe",
    "message": "Hello, I'd like to learn more."
  }
}

​

Security & Verification

​

Signature Header

​

Verification Steps

1. Get the raw request body — Use the raw bytes as received (do not parse and re-serialize JSON)
2. Compute HMAC-SHA256 — Using your webhook signing secret as the key
3. Compare with the header — The header value should match your computed signature
4. Reject if mismatched — Do not process requests with invalid signatures

const crypto = require('crypto');

function verifyWebhook(payload, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(signature, 'hex'),
    Buffer.from(expected, 'hex')
  );
}

​

Error Handling & Retries

​

Success Response

​

Automatic Retries

​

Timeout

​

Next Steps