Webhooks

Send signed form submissions to your endpoint.

A submission that only lands in an inbox can't trigger anything downstream. FormWire POSTs every submission to any endpoint you control as signed JSON, carrying an x-form-signature HMAC header you verify. It's configured per form, firing alongside the email and the stored record.

Get your access key → See how it works

A submission your systems can act on

What each webhook POST carries.

A JSON body you own

Every submission POSTs as JSON (id, form, fields and a spam flag) into your CRM sync, a queue or a custom endpoint.

Signed with an HMAC header

Each request carries an x-form-signature HMAC of the raw body. Verify it against your signing secret and you know the payload is FormWire's, untampered.

Retried on a failed POST

A non-2xx response or a timeout is retried automatically, so a brief outage on your endpoint doesn't drop the submission.

Only real leads reach your handler

Webhooks fire after spam filtering, so your endpoint processes genuine submissions instead of bot traffic.

Set up in under a minute

Wire a form to your endpoint in 3 steps.

Open the Integrations tab
From your form's Integrations tab, choose Webhooks. Everything for this destination is configured per form, right here.
Paste your endpoint URL
Add the HTTPS URL to POST to, then copy the signing secret FormWire generates. That secret is how you'll verify every request.
Receive and verify
New submissions arrive as JSON. Recompute the HMAC over the raw body and compare it to x-form-signature: match, and you trust the payload.

The payload

What lands at your endpoint.

A JSON body you can act on, and a signature you check first.

{
  "id": "sub_9fK2xQ7mB1",
  "form": "contact",
  "created_at": "2026-07-18T14:32:07Z",
  "spam": false,
  "data": {
    "name": "Dana Okafor",
    "email": "dana@example.com",
    "message": "Can you send over the API pricing tiers?"
  }
}

import crypto from "node:crypto";

// rawBody: the exact request body bytes, before any JSON parsing
function verify(rawBody, signature, secret) {
  const expected = crypto
    .createHmac("sha256", secret)
    .update(rawBody)
    .digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected),
  );
}

// const ok = verify(rawBody, req.headers["x-form-signature"], SIGNING_SECRET);

The exact header name, signature encoding and HMAC algorithm are pinned in the webhook docs. Verify against them before you ship your handler.

Webhooks FAQ

Payloads, verification and the details that matter.

No. Webhooks are a native FormWire destination. Add your endpoint URL in the form's Integrations tab and submissions POST straight to you. There's nothing to relay them through.

A JSON body with the submission id, the form it came from, a created_at timestamp, a spam flag, and a data object holding your form fields (name, email, message, and anything else the form collected).

Every request carries an x-form-signature header: an HMAC of the raw body keyed with your signing secret. Recompute it on your side and compare — a match proves the payload came from FormWire and wasn't altered in transit.

The usual cause is verifying against parsed-then-reserialized JSON instead of the raw body: re-serializing changes the bytes, so the HMAC won't match. Compute the HMAC over the exact raw request bytes, before any JSON parsing, using your signing secret, and compare with a constant-time check. If it still fails, confirm you're using the right secret for that form.

Nothing is lost. The submission is stored in your dashboard before delivery is attempted, and a failed POST is retried automatically, so a brief outage on your side won't drop a lead.

Yes. Webhooks are configured per form, so your contact form and your careers form can each POST to their own endpoint.

Webhooks are a Pro feature. Start on the free tier, add your endpoint when you upgrade. Your forms and access key don't change.

See pricing →

Want a different destination?

All integrations