Webhooks

{
  "submissionId": "64f1a2b3c4d5e6f7a8b9c0d1",
  "formId": "64f1a2b3c4d5e6f7a8b9c0d2",
  "formName": "Contact Form",
  "submittedAt": "2026-03-27T12:00:00.000Z",
  "data": {
    "name": "Jane Smith",
    "email": "jane@example.com",
    "message": "Hello!"
  }
}

X-osforms-Signature-256: sha256=<hex>

import crypto from 'crypto';

function verifySignature(
  rawBody: string,
  signature: string,
  secret: string
): boolean {
  const expected =
    'sha256=' +
    crypto.createHmac('sha256', secret).update(rawBody).digest('hex');

  return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
}

// Express example
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const sig = req.headers['x-osforms-signature-256'] as string;
  if (!verifySignature(req.body.toString(), sig, process.env.WEBHOOK_SECRET!)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }
  // Process the submission...
  res.json({ ok: true });
});