Webhooks

​

Enabling a webhook

1. Open a form in the dashboard → Settings → Webhooks.
2. Enter your endpoint’s https:// URL (webhook_url) and save.
3. The dashboard shows a signing secret (whsec_…) for this form - copy it; you’ll need it to verify incoming requests.

​

When it fires

​

Request

​

Payload

{
  "type": "submission.received",
  "version": 1,
  "id": "sub_...",
  "form_id": "frm_...",
  "created_at": 1720700000000,
  "data": {
    "name": "John Smith",
    "email": "john@example.com",
    "message": "Hello!"
  }
}

• type / version - the envelope. Only submission.received (version 1) exists today; new event types may be added later.
• data - your submitted fields, already cleaned: access_key, the botcheck honeypot, and any redirect control field are stripped and never included.

​

Verifying the signature

import crypto from "node:crypto";

function verify(rawBody, headers, secret, toleranceMs = 5 * 60_000) {
  const ts = Number(headers["x-formpaste-timestamp"]);
  if (!Number.isFinite(ts) || Math.abs(Date.now() - ts) > toleranceMs) return false;

  const expected =
    "sha256=" +
    crypto.createHmac("sha256", secret).update(`${ts}.${rawBody}`).digest("hex");
  const got = headers["x-formpaste-signature"] ?? "";

  const a = Buffer.from(expected);
  const b = Buffer.from(got);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

​

Retries, backoff & delivery log

​

Requirements & limits

• The URL must be https:// - plain HTTP is rejected. Loopback, private-network, link-local, and cloud-metadata addresses are rejected as SSRF protection, both on save and again before every send.
• One webhook URL per form.

​

Sending to Slack / Discord

​

Free vs. Pro

​

Zero-config