Send form submissions to your server as signed webhooks
A FormThunder webhook is an HTTPS POST of JSON to your URL for each form submission, signed with HMAC-SHA256 in the X-FormThunder-Signature header. Any non-2xx reply retries with backoff for up to 24 hours across 10 attempts, and each attempt's status shows in the dashboard. Webhooks need the Pro plan.
Updated
Set it up
- Add an HTTPS endpoint to your app that reads the raw request body.
- Set the URL on the form, and copy the signing secret from the form's webhook settings.
- Verify the signature, then return any 2xx. Do slow work after you reply: requests time out at 30 seconds.
{
"event": "submission.created",
"submission_id": "8f14e45f-...",
"form_id": "3f2a7c10-...",
"form_name": "Contact form",
"submitted_at": "2026-11-05T09:30:00.000Z",
"data": { "name": "Priya Raman", "email": "priya@example.com", "message": "Hi" },
"site_url": "https://example.com/contact",
"attachments": []
}import { createHmac, timingSafeEqual } from "node:crypto";
export function verify(rawBody, header, secret) {
const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
const expected = createHmac("sha256", secret).update(parts.t + "." + rawBody).digest("hex");
const ok = timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1));
const fresh = Math.abs(Date.now() / 1000 - Number(parts.t)) < 300;
return ok && fresh;
}What to know about Webhooks
- Compute the signature over the raw bytes you received. Parsing the JSON and serialising it again can change the bytes and break the match.
X-FormThunder-Deliverycarries a delivery id. A retry repeats the same id, so store it to ignore duplicates.- Return 410 Gone to stop retries for a delivery you never want. Other failures keep retrying until the attempts run out.
- You can also set a URL per submission with a hidden
webhookfield. It must be HTTPS.
Or ask your AI
An agent connected over MCP can set this up, send a test through it and read the result.
Send submissions from my contact form to Webhooks. Send a test and tell me whether it arrived.Questions
How long do webhook retries last?
About 24 hours across 10 attempts, waiting 30 seconds, 2 minutes, 10 minutes, 30 minutes, 1 hour, 2 hours, 4 hours, 8 hours and 8 hours.
Can I replay a failed webhook?
Yes. Press resend on the submission, call POST /api/v1/submissions/:id/resend, or ask your AI to run resend_deliveries.
Connect your form to Webhooks
Integrations are on Pro at $12 a month and Agency at $39 a month. The form itself is free to start.