Form webhooks — real-time POST to any URL on every submission

splitforms turns every form submission into a signed HTTP POST that lands at any URL you choose, within roughly one second of the user clicking Submit. Add a webhook in the dashboard, and from then on your endpoint receives a JSON payload containing form_id, submission_id, an ISO-8601 created_at timestamp, the form fields under data, any uploaded files under files (as signed download URLs with size and MIME), and request metadata under meta (ip, country, user_agent, referer). Each request includes an X-Splitforms-Signature header — an HMAC-SHA256 of the raw request body, signed with the per-webhook secret in your dashboard — so your endpoint can verify it really came from splitforms rather than a stranger guessing your URL. If your endpoint is down, slow (timeout is 10 seconds), or returns a non-2xx response, splitforms retries with exponential backoff: 30 seconds, then 2 minutes, 10 minutes, 1 hour, 6 hours, then daily for up to 24 hours. Every attempt — successful or failed — appears in the delivery log with the full response body, status code, and latency, and any past submission can be manually replayed against your endpoint with one click. Fan out to as many webhooks per form as you need (one for your CRM, one for Slack, one for an internal Postgres, one for a Lambda), each with its own signing secret and independent retry queue. No polling, no cron, no missed leads.

// Add this URL inside your splitforms dashboard → Form → Webhooks.
// Every submission will POST a JSON body to this endpoint within ~1s.

// ─── Example: Next.js 14 App Router route handler ───────────────────
import { NextRequest, NextResponse } from "next/server";
import crypto from "node:crypto";

const SECRET = process.env.SPLITFORMS_WEBHOOK_SECRET!;

export async function POST(req: NextRequest) {
  // 1. Read the RAW body (do not JSON.parse before verifying)
  const raw = await req.text();
  const sig = req.headers.get("x-splitforms-signature") ?? "";