Feature · Webhooks
Updated · plan facts checked against /pricing
Pipe submissions into your CRM, Slack bot, Postgres, or homemade Lambda — anywhere that speaks HTTP. Signed payloads, auto-formatted chat delivery, per-webhook delivery status in the dashboard.
Your form posts to one splitforms endpoint — no server, API route, or SDK. splitforms is the backend.
Every submission is saved to a searchable dashboard and emailed to you — spam filtered before it lands.
No glue code, no third-party middleman — it ships as part of splitforms and works from your first submission.
Copy-paste ready
Replace YOUR_ACCESS_KEY with the key from your splitforms dashboard. No SDK to install, no build step — the same ts you already write.
// Add this URL inside your splitforms dashboard → Form → Webhooks.
// Every submission will POST a JSON body to this endpoint within ~1s.
// ─── Example: Next.js 14 App Router route handler ───────────────────
import { NextRequest, NextResponse } from "next/server";
import crypto from "node:crypto";
const SECRET = process.env.SPLITFORMS_WEBHOOK_SECRET!;
export async function POST(req: NextRequest) {
// 1. Read the RAW body (do not JSON.parse before verifying)
const raw = await req.text();
// Header format: "sha256=<hex hmac of the raw body>"
const sig = req.headers.get("x-splitforms-signature") ?? "";
// 2. Verify HMAC-SHA256 signature in constant time
const expected =
"sha256=" + crypto.createHmac("sha256", SECRET).update(raw).digest("hex");
const ok =
sig.length === expected.length &&
crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected));
if (!ok) return NextResponse.json({ error: "bad signature" }, { status: 401 });
// 3. Parse and use the payload
const payload = JSON.parse(raw) as {
event: "submission.created";
submission: {
id: string;
form_name: string | null;
data: Record<string, unknown>; // your form fields, key → value
ip_address: string | null;
referer: string | null;
created_at: string; // ISO 8601, UTC
};
};
await sendToCRM(payload.submission.data);
// 4. Reply 2xx within 8s — the request is aborted after that. Network
// errors, timeouts and 5xx get ONE automatic retry ~2s later; the
// final status is recorded in the dashboard.
return NextResponse.json({ ok: true });
}
// ─── Minimal Express equivalent ─────────────────────────────────────
// app.post("/webhooks/splitforms",
// express.raw({ type: "application/json" }),
// (req, res) => { /* same verify + handle */ });
How to set it up
How webhooks flows through splitforms — what you do, what we do, and what lands in your inbox.
Open Form → Integrations → Webhooks → New webhook. Paste any HTTPS URL (HTTP works in development with a localhost tunnel like ngrok). Each webhook gets its own signing secret displayed once on creation — copy it into your env file as SPLITFORMS_WEBHOOK_SECRET.
Within ~1 second of submission, splitforms POSTs Content-Type: application/json to your URL with { event: 'submission.created', submission: { id, form_name, data, ip_address, referer, created_at } } — data holds your form fields. The X-Splitforms-Signature header is 'sha256=' followed by the hex HMAC-SHA256 of the raw request body. Verify with constant-time comparison BEFORE parsing, then return any 2xx within 8 seconds.
Each webhook keeps a 30-day delivery log with the status, error, and attempt count of every POST, so you can spot a broken endpoint immediately. Deliveries time out after 8 seconds and get one automatic retry on network errors, timeouts, and 5xx; once your endpoint is fixed, Replay re-sends the original submission in one click.
Webhooks
By default a generic webhook sends { "event": "submission.created", "submission": { ... } }, where submission holds the id, form_name, data (every field), ip_address, referer and created_at, plus a files array when the submission carried stored uploads.
On Pro ($5 per month) or Annual ($49 per year) you can replace that body with your own JSON from the webhook's Custom payload panel, which previews the result as you type. Put placeholders inside string values: { "email": "{{ email }}", "source": "Site: {{ submission.form_name }}" }. Field names match exactly first, then ignoring case, so {{ email }} also finds a field named Email.
A string that is exactly one placeholder keeps the value's real type: "{{ submission.data }}" becomes an object and a checkbox group stays an array. A placeholder mixed with other text is inserted as text. Missing values become null, or an empty string inside text. The built-in placeholders are submission.data, submission.id, submission.form_name, submission.form_id, submission.created_at, submission.ip_address, submission.referer and submission.files (download links that expire about 7 days after the submission).
The template has to be valid JSON (an object or an array) under 10,000 characters. It is parsed once and filled value by value, so nothing a visitor types can break the JSON your endpoint receives. If a saved template ever fails to parse, splitforms sends the standard payload instead of dropping the event. WhatsApp and Telegram hooks send plain text and don't take a template.
Custom or not, every request is signed: the X-Splitforms-Signature header is sha256= followed by the hex HMAC-SHA256 of the exact body, using that webhook's secret, so verify against the raw body. Each request times out after 8 seconds. A timeout, network error or 5xx gets one automatic retry about 2 seconds later; a 4xx is not retried.
How webhooks works
splitforms turns every form submission into a signed HTTP POST that lands at any URL you choose, within roughly one second of the user clicking Submit. Add a webhook in the dashboard, and from then on your endpoint receives a JSON payload with the submission fields, the submission id, and a created_at timestamp. Route the same submission to an email inbox or a webhook at the same time — nothing here is one-or-the-other.
What you get
Every reason below is the boring, reliable kind — the fundamentals of webhooks, built once and tested in production so you never have to.
How SplitForms works
splitforms receives the submission, filters spam, saves it to your dashboard and emails you — then, on paid plans, sends it on to your webhooks and integrations. No backend infrastructure to build.
Point your form to your unique SplitForms endpoint. That's it.
We instantly capture and organize every submission in your inbox.
Send data to email, spreadsheets, CRMs, webhooks, and 7,000+ apps.
No credit card required. Set up in under 60 seconds.
Connect & automate
On paid plans, submissions can also go to Slack, Discord, Google Sheets, Notion, Airtable, Zapier or any signed webhook — and splitforms works on the platforms you build on, from WordPress and Shopify to Next.js. With Stripe connected, your forms can take payments too.
NewTake payments on your formsDeposits, bookings, order forms — submitters check out through Stripe and the money goes straight to your Stripe account. Included on every paid plan.See payment forms →Need time slots? Online booking →Common questions
Every webhook is a POST with Content-Type: application/json. For a generic URL, the body is { event: "submission.created", submission: { id, form_name, data, ip_address, referer, created_at } }, where data holds your form fields as a key-value object. The X-Splitforms-Signature header is 'sha256=' followed by the hex HMAC-SHA256 of the raw request body, computed with the per-webhook secret — use it to verify the request really came from splitforms. There's also an X-Splitforms-Event header (currently always 'submission.created'). If your URL matches a known Slack, Discord, Telegram, or WhatsApp (CallMeBot) endpoint, splitforms detects it and sends that platform's native message format instead of the generic JSON shape.
Webhooks are included on the paid plans: Pro ($5 per month, 5,000 submissions a month) and Annual ($49 per year, 15,000 a month, every Pro feature). There is no per-webhook fee, no per-event fee, and no event-volume cap beyond your monthly submission limit. Forms are unlimited on every plan, including Free.
Dashboard → your form → Integrations → Webhooks → Add webhook → paste your HTTPS URL → save. Copy the signing secret shown once on creation into your env (e.g. SPLITFORMS_WEBHOOK_SECRET). On your endpoint: read the RAW request body BEFORE JSON.parse (Express needs express.raw(), Next.js gets it via req.text()), compute 'sha256=' + crypto.createHmac('sha256', SECRET).update(rawBody).digest('hex'), and compare to the X-Splitforms-Signature header using crypto.timingSafeEqual. Respond within 8 seconds — a failed delivery (network error, timeout, or 5xx) is retried once automatically a couple of seconds later; if that also fails it's marked failed in the delivery log, where Replay re-sends it once your endpoint is fixed.
Yes — webhooks are framework-agnostic since they're just HTTP POSTs. Patterns: Next.js App Router uses route handlers (app/api/webhooks/splitforms/route.ts with req.text() to get raw body). Express needs app.post('/hook', express.raw({ type: 'application/json' }), handler). FastAPI: read request.body() before request.json(). Cloudflare Workers / Lambda / Supabase Edge Functions: use Web standard Request and call .text() before parsing. The signature scheme (raw-body HMAC-SHA256, hex-encoded) is identical everywhere.
Open Dashboard → Integrations → Webhook — each webhook shows its last-triggered time, last HTTP status, last error, and a 30-day delivery log. Common causes and fixes: (1) signature mismatch — you're parsing JSON before reading the raw body, so the hash differs (switch to req.text() / express.raw() and verify against the raw bytes), or you're comparing a bare hex digest against the header, which is 'sha256='-prefixed. (2) Returning non-2xx — a 5xx gets one automatic retry, a 4xx does not; if you intentionally reject a submission, still return 200 so the dashboard doesn't show it as failed. (3) Timeout — the request is aborted after 8 seconds; offload heavy work to a queue and respond fast. (4) URL behind auth — splitforms can't pass cookies; use signature verification, not basic auth. (5) Localhost — use ngrok or a tunnel; splitforms can't reach 127.0.0.1. After fixing the issue, click Replay on the failed delivery (or use Test webhook) to confirm delivery.
Simple pricing
Free gives you 500 submissions for $0 — no card, no time limit. Pro is $5/month for 5,000 submissions a month, and Annual is $49/year for 15,000 a month with every Pro feature.
For side projects and indie devs.
Every paid feature, for agencies and growing products.
Every Pro feature with triple the volume — $0.27 per 1,000 at full use.
No credit card required on Free • Cancel anytime • Full pricing and FAQ
