Form webhook defined.
A form webhook is an HTTP POST a form backend sends to a URL you choose when a submission arrives, one request per submission, carrying the submitted data as JSON.
How a form webhook works
A webhook inverts the usual direction of an API. Instead of your code polling a service on a timer to ask whether anything happened, the service calls you: the moment the event fires, it POSTs the details to a URL you registered. Your endpoint receives the payload, does whatever the event warrants (write to a CRM, open a ticket, kick off an automation) and answers with a success status. Data arrives the moment it exists, and your code runs only when there's something to run on.
For a form backend the event is a submission. FormWire POSTs each one to your endpoint as JSON, and because your endpoint is reachable from the open internet, every request is signed: an x-form-signature header carries an HMAC of the raw request body, keyed with your webhook secret. Recompute the HMAC on your side and compare, a match proves the payload came from FormWire and wasn't altered in transit. Failed deliveries retry with backoff, and the submission is stored before delivery is ever attempted, so an endpoint outage costs you nothing but a delay.
What a form webhook carries.
Pushed, not polled
The request fires when the submission happens. Your CRM, database or automation hears about a lead in real time.
Signed payloads
The x-form-signature HMAC header lets your handler verify the sender before trusting a byte of the body.
Retried until received
A non-success response or timeout triggers retries with backoff, and an idempotency key lets you deduplicate them.
Related questions
Direction. With an API your code calls the service and asks; with a webhook the service calls your code and tells. They're complements. FormWire pushes each submission by webhook and also offers a JSON read API for pulling stored submissions on your own schedule.
Verify the signature. Each request's x-form-signature header is an HMAC of the raw body, keyed with your secret. Recompute it over the exact bytes you received, before any JSON parsing, and compare with a constant-time check. Re-serialized JSON changes the bytes and breaks the match, which is the classic verification bug.
How HMAC signing works →The delivery retries with backoff, and the submission itself was stored before the first attempt, so it's waiting in your dashboard regardless of what your server was doing. A webhook failure delays the push; it never loses the lead.
The email is for you; the webhook is for your systems. A submission that only lands in an inbox can't create a CRM contact, post to a channel or trigger a workflow. Webhooks are how form data stops terminating at a human.
Want to see it working?
Read the docsPush every submission into your stack.
Free tier forever. No credit card required.