Formtorch now supports outgoing webhooks. Every time a form submission arrives, Formtorch can push a signed JSON payload to any HTTPS endpoint you control: a Slack Incoming Webhook, a Zapier or Make trigger URL, your own backend, or any other service that accepts HTTP POST requests.

Webhook destinations

Webhook endpoints are configured at the workspace level under Settings → Webhooks. One endpoint receives events from all your forms. You can add multiple endpoints and subscribe each one to a different set of events.

When you create an endpoint, Formtorch generates a signing secret and shows it once. Store it immediately alongside other secrets in your environment — it cannot be recovered after you leave the page.

Events

Each endpoint can subscribe to one or more of the following events:

• form.submitted — a real, non-spam submission was received
• form.spam — TorchWarden flagged a submission as spam
• form.test — a test submission sent via the dashboard or with _test=true

The event name is included in both the payload body and the X-FormTorch-Event request header, so you can route events before parsing the body.

Payload and signature

Every request is a POST with a JSON body and three additional headers:

• X-FormTorch-Signature — HMAC-SHA256 of the raw request body, prefixed with sha256=
• X-FormTorch-Event — the event name, e.g. form.submitted
• X-FormTorch-Delivery — a unique delivery ID that matches delivery_id in the body

Always verify the signature before processing. Read the raw request body as a string before calling JSON.parse — parsing first changes the string and breaks the check.

Reserved fields (those starting with _, like _redirect and _honeypot) are stripped from submission.data before delivery.

Durable delivery with automatic retries

Webhook delivery is backed by a durable job queue. If your endpoint returns a non-2xx response or does not respond within 30 seconds, Formtorch retries with exponential backoff for up to 6 total attempts. After all attempts are exhausted, the delivery is marked failed and surfaced in the delivery log.

Return 200 OK immediately and process asynchronously if your handler takes more than a few seconds.

Delivery log and manual retry

The delivery log for each endpoint is visible in Settings → Webhooks. It shows the status, attempt count, HTTP response code, and response time for recent deliveries. Failed deliveries are surfaced clearly so nothing gets silently dropped. A Retry button is available on any failed delivery if you want to re-send without waiting.

Test without a live form

Each endpoint has a Send Test button that fires a form.test event immediately. Use it to confirm your endpoint URL, verify your signature verification code, and check the delivery log before you go live, all without submitting a real form.

---

Webhook delivery is available on the Starter and Pro plans. For setup instructions, payload reference, and signature verification examples, see the Webhooks docs.