Webhooks

{
  "event": "form.submission",
  "formId": "64f1a2b3c4d5e6f7a8b9c0d2",
  "formName": "Contact Form",
  "submissionId": "64f1a2b3c4d5e6f7a8b9c0d1",
  "submittedAt": "2026-10-02T12:00:00.000Z",
  "data": {
    "name": "Jane Smith",
    "email": "[email protected]",
    "message": "Hello!"
  }
}

X-osforms-Signature: 5d41402abc4b2a76b9719d911017c592...

import crypto from 'crypto';

function verifySignature(rawBody: string, signature: string, secret: string) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex');

  const a = Buffer.from(signature);
  const b = Buffer.from(expected);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

// Express example
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const sig = req.header('x-osforms-signature') ?? '';
  if (!verifySignature(req.body.toString(), sig, process.env.WEBHOOK_SECRET!)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }
  const payload = JSON.parse(req.body.toString());
  // Process payload.data...
  res.json({ ok: true });
});