Formgong + n8n: catch form submissions with the Webhook node

Before you start

• n8n Cloud: paid plans from 20 € a month billed yearly, with a free trial. n8n says hosted data stays in Frankfurt, Germany.
• Self-hosted n8n: the Community Edition is free. Formgong only posts to HTTPS on port 443 and a public host. http://localhost:5678 or a LAN address will be refused. Put n8n behind a reverse proxy with a TLS certificate, and set n8n's WEBHOOK_URL to that public address.
• Formgong: one webhook per form on Free, five on Pro and Business. Swapping the test URL for the production URL uses the same slot.

Step by step

1. Create a workflow and add the Webhook node as the trigger.
2. Set HTTP Method to POST. Give it a readable Path, for example formgong-contact.
3. Leave Authentication on None. Formgong cannot send Basic, header or JWT credentials. Use the signature check below instead. Do not use the IP allowlist either: Formgong sends from Cloudflare's network, not from fixed addresses.
4. Set Respond to Immediately. Formgong waits only 10 seconds for an answer.
5. Copy the Test URL. In Formgong, open Form settings → Webhook, paste it and click Add webhook.
6. In n8n, click Listen for test event. Then send a real submission from your site.
7. Add your next nodes and map the fields. When everything works, remove the test URL in Formgong and add the Production URL.
8. Publish the workflow. Production runs appear under Executions, not on the canvas.

What the Webhook node outputs

The node gives you headers, params, query and body. Formgong's JSON is in body.

{
  "event": "submission.created",
  "form": {
    "id": "6f1c2a9e-4b7d-4e0a-9c3f-2d8b5e7a1f40",
    "name": "Contact"
  },
  "submission": {
    "id": "b3e04c51-8a2f-4d6e-9f17-0c5a3b8d2e96",
    "created_at": "2026-10-03T09:15:00.000Z",
    "page_url": "https://example.com/contact",
    "fields": {
      "name": "Sam Carter",
      "email": "sam@example.com",
      "phone": "+447700900123",
      "message": "Can you send a quote for 20 units?",
      "utm_source": "google"
    },
    "is_spam": false
  }
}

Header names arrive in lower case, for example $json.headers["x-signature"] and $json.headers["x-formgong-event"].

Field mapping

To skip test deliveries, open the Webhook node options and use Only Run If with {{ $json.body.event === 'submission.created' }}. Requests that do not match still get a 200 answer, so Formgong does not retry them.

Optional: check the signature

The signature is an HMAC-SHA256 of the raw body, keyed with the Signing secret from Formgong's Webhook tab. n8n can check it without code:

1. In the Webhook node options, turn on Raw Body. The body now arrives as binary data.
2. Add a Crypto node: action Hmac, Binary File on, the binary property from the Webhook node, type SHA256, encoding HEX. Put the signing secret in the Crypto credential's Hmac Secret.
3. Add an If node: sha256= plus the Crypto output must equal {{ $('Webhook').item.json.headers['x-signature'] }}.
4. On the true branch, use Extract from File (Extract From JSON) to turn the raw body back into fields.

SECRET='<your signing secret>'
URL='<your webhook URL>'
BODY='{"event":"webhook.test","form":{"id":"x","name":"Test"},"submission":{"id":"test","created_at":"2026-10-03T09:15:00.000Z","page_url":null,"fields":{"message":"Formgong test"},"is_spam":false}}'
SIG=$(printf '%s' "$BODY" | openssl dgst -sha256 -hmac "$SECRET" | sed 's/^.* //')
curl -sS -X POST "$URL" \
  -H 'content-type: application/json' \
  -H 'x-formgong-event: webhook.test' \
  -H "x-signature: sha256=$SIG" \
  --data "$BODY"

Troubleshooting

• 404 in Recent deliveries: the Test URL only works while n8n is listening, for one call. The Production URL only works when the workflow is published.
• Formgong refuses the URL: it must start with https://, use port 443 and point to a public host.
• Timeouts and duplicates: with Respond set to When Last Node Finishes, a slow workflow can pass 10 seconds. Formgong then retries and the workflow runs again. Respond Immediately, and check submission.id before you create records.
• 3xx status: a proxy that redirects (for example http to https, or a missing slash) counts as a failure. Paste the exact URL n8n shows.
• Checkbox group in one field: ticked boxes with the same name arrive as one string, for example Email, Phone. To get an array, use {{ $json.body.submission.fields.contact.split(', ') }}.