Webhooks

{
  "event": "submission.created",
  "timestamp": "2026-01-01T00:00:00.000Z",
  "form": {
    "id": "form_123",
    "name": "Contact Form",
    "slug": "contact"
  },
  "submission": {
    "id": "sub_xyz789",
    "data": {
      "email": "user@example.com",
      "name": "John Doe",
      "message": "Hello, I have a question..."
    },
    "createdAt": "2026-01-01T00:00:00.000Z"
  }
}

X-FormBnB-Timestamp: 1767225600000
X-FormBnB-Signature: abc123...

import crypto from 'crypto';

function verifySignature(payload, timestamp, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${payload}`)
    .digest('hex');
  
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
}

// Express.js example
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-formbnb-signature'];
  const timestamp = req.headers['x-formbnb-timestamp'];
  const isValid = verifySignature(req.body.toString(), timestamp, signature, process.env.WEBHOOK_SECRET);
  
  if (!isValid) {
    return res.status(401).send('Invalid signature');
  }
  
  const data = JSON.parse(req.body);
  // Process the webhook...
  
  res.status(200).send('OK');
});

ngrok http 3000

const express = require('express');
const app = express();

app.post('/webhook', express.json(), (req, res) => {
  const { submission } = req.body;
  
  console.log('New submission:', submission.data.email);
  
  // Process the submission...
  
  res.status(200).send('OK');
});

from flask import Flask, request

app = Flask(__name__)

@app.route('/webhook', methods=['POST'])
def webhook():
    data = request.json
    
    print(f"New submission: {data['submission']['data']['email']}")
    
    # Process the submission...
    
    return 'OK', 200

// app/api/webhook/route.ts
import { NextResponse } from 'next/server';
import crypto from 'crypto';

export async function POST(request: Request) {
  const body = await request.text();
  const signature = request.headers.get('x-formbnb-signature');
  const timestamp = request.headers.get('x-formbnb-timestamp');
  
  // Verify signature
  const expected = crypto
    .createHmac('sha256', process.env.WEBHOOK_SECRET!)
    .update(`${timestamp}.${body}`)
    .digest('hex');
  
  if (expected !== signature) {
    return NextResponse.json({ error: 'Invalid signature' }, { status: 401 });
  }
  
  const data = JSON.parse(body);
  
  // Process the submission...
  console.log('New submission:', data.submission.data.email);
  
  return NextResponse.json({ received: true });
}