Webhooks

Add a webhook under a form's Webhooks tab. Every accepted submission is POSTed to your URL as JSON, with automatic retries.

Payload

{
  "formId": "…",
  "submissionId": "…",
  "createdAt": "2026-01-01T12:00:00Z",
  "spamVerdict": "Clean",
  "data": { "email": "ada@example.com", "message": "Hello" }
}

Headers

Verifying the signature

We sign the raw request body with your webhook's secret using HMAC-SHA256. Verify it before trusting the payload:

import crypto from "node:crypto";

function verify(rawBody, header, secret) {
  const expected = "sha256=" + crypto
    .createHmac("sha256", secret)
    .update(rawBody)
    .digest("hex");
  return crypto.timingSafeEqual(Buffer.from(header), Buffer.from(expected));
}

Zapier & automation tools

Point a Zapier "Catch Hook" (or any automation tool) at a generic webhook URL — the payload above is exactly what it receives.

Requirements

Webhook URLs must be https and must not point at private or internal addresses.