Feature · Webhooks
Pipe submissions into your CRM, Slack bot, Postgres, or homemade Lambda — anywhere that speaks HTTP. Signed payloads, auto-formatted chat delivery, per-webhook delivery status in the dashboard.
Your form posts to one splitforms endpoint — no server, API route, or SDK. splitforms is the backend.
Every submission is saved to a searchable dashboard and emailed to you — spam filtered before it lands.
No glue code, no third-party middleman — it ships as part of splitforms and works from your first submission.
Copy-paste ready
Replace YOUR_ACCESS_KEY with the key from your splitforms dashboard. No SDK to install, no build step — the same ts you already write.
// Add this URL inside your splitforms dashboard → Form → Webhooks.
// Every submission will POST a JSON body to this endpoint within ~1s.
// ─── Example: Next.js 14 App Router route handler ───────────────────
import { NextRequest, NextResponse } from "next/server";
import crypto from "node:crypto";
const SECRET = process.env.SPLITFORMS_WEBHOOK_SECRET!;
export async function POST(req: NextRequest) {
// 1. Read the RAW body (do not JSON.parse before verifying)
const raw = await req.text();
// Header format: "sha256=<hex hmac of the raw body>"
const sig = req.headers.get("x-splitforms-signature") ?? "";
// 2. Verify HMAC-SHA256 signature in constant time
const expected =
"sha256=" + crypto.createHmac("sha256", SECRET).update(raw).digest("hex");
const ok =
sig.length === expected.length &&
crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected));
if (!ok) return NextResponse.json({ error: "bad signature" }, { status: 401 });
// 3. Parse and use the payload
const payload = JSON.parse(raw) as {
event: "submission.created";
submission: {
id: string;
form_name: string | null;
data: Record<string, unknown>; // your form fields, key → value
ip_address: string | null;
referer: string | null;
created_at: string; // ISO 8601, UTC
};
};
await sendToCRM(payload.submission.data);
// 4. Reply 2xx within 8s — the request is aborted after that, and a
// failed delivery is recorded in the dashboard (not auto-retried).
return NextResponse.json({ ok: true });
}
// ─── Minimal Express equivalent ─────────────────────────────────────
// app.post("/webhooks/splitforms",
// express.raw({ type: "application/json" }),
// (req, res) => { /* same verify + handle */ });
How to set it up
How webhooks flows through splitforms — what you do, what we do, and what lands in your inbox.
Open Form → Integrations → Webhooks → New webhook. Paste any HTTPS URL (HTTP works in development with a localhost tunnel like ngrok). Each webhook gets its own signing secret displayed once on creation — copy it into your env file as SPLITFORMS_WEBHOOK_SECRET.
Within ~1 second of submission, splitforms POSTs Content-Type: application/json to your URL with { event: 'submission.created', submission: { id, form_name, data, ip_address, referer, created_at } } — data holds your form fields. The X-Splitforms-Signature header is 'sha256=' followed by the hex HMAC-SHA256 of the raw request body. Verify with constant-time comparison BEFORE parsing, then return any 2xx within 8 seconds.
Each webhook shows its last-triggered time, last HTTP status, and last error (if any) right in the dashboard, so you can spot a broken endpoint immediately. Delivery gets one attempt with an 8-second timeout and no automatic retry, so make sure your endpoint responds quickly and reliably.
How webhooks works
splitforms turns every form submission into a signed HTTP POST that lands at any URL you choose, within roughly one second of the user clicking Submit. Add a webhook in the dashboard, and from then on your endpoint receives a JSON payload with the submission fields, the submission id, and a created_at timestamp. Route the same submission to an email inbox or a webhook at the same time — nothing here is one-or-the-other.
What you get
Every reason below is the boring, reliable kind — the fundamentals of webhooks, built once and tested in production so you never have to.
How SplitForms works
Connect your form, collect every submission, and send data where it needs to go — without building backend infrastructure.
Point your form to your unique SplitForms endpoint. That's it.
We instantly capture and organize every submission in your inbox.
Send data to email, spreadsheets, CRMs, webhooks, and 7,000+ apps.
No credit card required. Set up in under 60 seconds.
Connect & automate
SplitForms works with the destinations you route to and the platforms you build on — from Slack and Sheets to WordPress, Shopify, and Next.js.
Trusted by indie teams and agencies shipping forms worldwide
Testimonials
40 quotes on record — from indie hacks to agency migrations.
“I replaced a Lambda + DynamoDB + SES contact form with six lines of HTML. It took eleven minutes, and the dashboard is better than what I was going to build.”
“We migrated 14 client sites off Formspree in a single weekend. The price is a third of what we paid, the API is more honest, and the spam filter actually works.”
“The webhook payload is signed, idempotent, and well-shaped. It reads like code from a competent team, not a CRUD app held together with duct tape.”
“I stopped reaching for Typeform on small marketing sites. splitforms covers 90% of the use case at none of the bloat.”
“I onboarded our whole agency in an afternoon. The MCP integration meant Cursor literally dropped the form straight into our client repos for us.”
“The free plan gave me 500 submissions before I paid a cent, and Pro is five dollars a month. I've spent more on coffee deciding which backend to use.”
“Spam went from forty junk entries a day to zero, with no reCAPTCHA puzzle ruining the form. The honeypot and time-trap just quietly do their job.”
“Point the form action at one endpoint and you're done. No SDK, no client library, no build step. This is how a form backend should feel.”
“Leads land in Slack the second someone submits, and a copy goes to Google Sheets for the sales team. I wired both up in under ten minutes.”
“I run a static Hugo site on a five-dollar VPS. splitforms gave it a real contact form without me standing up a single server.”
Common questions
Every webhook is a POST with Content-Type: application/json. For a generic URL, the body is { event: "submission.created", submission: { id, form_name, data, ip_address, referer, created_at } }, where data holds your form fields as a key-value object. The X-Splitforms-Signature header is 'sha256=' followed by the hex HMAC-SHA256 of the raw request body, computed with the per-webhook secret — use it to verify the request really came from splitforms. There's also an X-Splitforms-Event header (currently always 'submission.created'). If your URL matches a known Slack, Discord, Telegram, or WhatsApp (CallMeBot) endpoint, splitforms detects it and sends that platform's native message format instead of the generic JSON shape.
Webhooks unlock on Pro ($5/month) and above. There is no per-webhook fee, no per-event fee, and no event-volume cap beyond your monthly submission limit. Pro includes 5,000 submissions/month and unlimited forms; Pro ($5/month) and the $59 3-year plan raise the monthly submission cap further. Forms are unlimited on every plan, including Free.
Dashboard → your form → Integrations → Webhooks → Add webhook → paste your HTTPS URL → save. Copy the signing secret shown once on creation into your env (e.g. SPLITFORMS_WEBHOOK_SECRET). On your endpoint: read the RAW request body BEFORE JSON.parse (Express needs express.raw(), Next.js gets it via req.text()), compute 'sha256=' + crypto.createHmac('sha256', SECRET).update(rawBody).digest('hex'), and compare to the X-Splitforms-Signature header using crypto.timingSafeEqual. Respond within 8 seconds — deliveries are not currently retried automatically, so a slow or failing endpoint means that submission's webhook delivery is simply marked failed in the dashboard.
Yes — webhooks are framework-agnostic since they're just HTTP POSTs. Patterns: Next.js App Router uses route handlers (app/api/webhooks/splitforms/route.ts with req.text() to get raw body). Express needs app.post('/hook', express.raw({ type: 'application/json' }), handler). FastAPI: read request.body() before request.json(). Cloudflare Workers / Lambda / Supabase Edge Functions: use Web standard Request and call .text() before parsing. The signature scheme (raw-body HMAC-SHA256, hex-encoded) is identical everywhere.
Open Dashboard → Form → Webhooks — each webhook row shows its last-triggered time, last HTTP status, and last error message. Common causes and fixes: (1) signature mismatch — you're parsing JSON before reading the raw body, so the hash differs (switch to req.text() / express.raw() and verify against the raw bytes), or you're comparing a bare hex digest against the header, which is 'sha256='-prefixed. (2) Returning non-2xx — a failed delivery is recorded but not currently retried, so make your endpoint reliable; if you intentionally reject a submission, still return 200. (3) Timeout — the request is aborted after 8 seconds; offload heavy work to a queue and respond fast. (4) URL behind auth — splitforms can't pass cookies; use signature verification, not basic auth. (5) Localhost — use ngrok or a tunnel; splitforms can't reach 127.0.0.1. Since there's no automatic retry yet, fix the issue and submit the form again to confirm delivery.
Simple pricing
Choose a plan that fits your workflow — from a free form endpoint to full automations, exports, and higher submission limits.
Free forever
For side projects and indie devs.
For agencies and growing products.
Pay $59. 3 years sorted.
No credit card required on Free • Cancel anytime
