What your endpoint receives
- A
POSTwithContent-Type: application/jsonandUser-Agent: Formgong-Webhook. X-Formgong-Eventsays what happened:submission.created, orwebhook.testfor the test button.X-Signature: sha256=<hex>is an HMAC-SHA256 of the raw body with your signing secret, so your code can reject anything Formgong did not send.- The body has the form id and name, the submission id, time and page, every field, and
is_spam. Spam and held submissions are not sent at all. - Your endpoint has 10 seconds to answer with a 2xx status.
Webhooks on other form backends
We read each service's own pricing and docs on 12.10.2026. Where their docs say nothing, the table says so.
| Formgong | Formspree | Web3Forms | Basin | Forminit | Formcarry | Formspark | |
|---|---|---|---|---|---|---|---|
| On the free plan | Yes, 1 per form | No, from Professional at $30 a month | No, Pro plan only | No, from Growth at $24.17 a month billed yearly | No, from Pro | No, paid plans | Yes |
| Signed | HMAC-SHA256, X-Signature | HMAC-SHA256 | Not in their docs | HMAC-SHA256, on Growth and up | HMAC-SHA256 | HMAC-SHA256 | No, their docs say they do not sign |
| Retries | 5 tries over about 42 minutes | Not in their docs | Automatic; count not stated | Up to 15 times over 24 to 28 hours | Exponential backoff; count not stated | For up to 3 days | Not in their docs |
| Test button | Yes, Send test | Not in their docs | Send a test entry yourself | Not in their docs | Yes | Not in their docs | Send a test entry yourself |
| Delivery log | Yes, Recent deliveries | Not in their docs | No | Yes, with re-fire | Yes | Yes, through their API | Not in their docs |
| Webhooks per form | 3 on Free, 5 on Pro | Not in their docs | One URL | Not in their docs | Not in their docs | Up to 10 | One URL |
Two services do better on one row each. Basin keeps retrying for a day and Formcarry for three, against our 42 minutes; Formcarry also allows 10 webhooks per form. None of the others puts a signed webhook with retries on its free plan.
Add a webhook
- Open My forms, then your form, then Form settings. If the Webhook tab is hidden, click Open expert mode.
- Paste your HTTPS URL and click Add webhook. The form's signing secret is under Signing secret in the same tab.
- Click Send test. Your endpoint receives a webhook.test event, and Recent deliveries shows the answer.
- Send the form from your site. Each accepted submission arrives as a signed submission.created POST.
The URL must use HTTPS on port 443 and point to a public host, with no password inside it, and be at most 2,048 characters. A Slack Incoming Webhook or a Discord channel webhook URL gets a formatted chat message instead of JSON; see Slack and Discord.
Check the signature
Compute HMAC-SHA256 of the raw request body with your signing secret and compare it with the hex after sha256= in X-Signature, using a constant-time comparison. Read the body as text before parsing it, because re-serialised JSON will not match. Ready-made checks for Node.js, Make, n8n and Zapier are in the webhook reference and the signature guide.
When your endpoint is down
Formgong tries 5 times, waiting 30 seconds, 2 minutes, 10 minutes and 30 minutes between tries. Recent deliveries shows each attempt with its status. After the last failed try the owner gets one email, at most once a day per form and channel. The submission stays in the inbox and is emailed to you on every plan, so nothing is lost while your endpoint is fixed.
For no-code tools, the same JSON feeds Make, n8n and Zapier.
Questions
Are form webhooks free?
Yes. The free plan has three webhooks per form, signed and retried like on paid plans. Pro has five per form.
How do I know a webhook came from Formgong?
Each request carries X-Signature: sha256=<hex>, an HMAC-SHA256 of the raw body with your signing secret. Recompute it and compare before you trust the data.
What happens if my endpoint is down?
Formgong retries 5 times over about 42 minutes and logs every attempt. After the last failure the owner gets one email. The submission stays in the inbox.
Can I send the form to Slack or Discord with a webhook?
Yes. Paste a Slack Incoming Webhook or a Discord channel webhook URL and Formgong sends a formatted chat message instead of JSON.
Are spam submissions sent to the webhook?
No. Spam and held submissions stay in the inbox and are not delivered.
Sources
Checked on 12.10.2026 against these public pages: Formspree: plans, Formspree Help: webhooks, Web3Forms docs: webhooks, Basin docs: webhooks, Basin: pricing, Forminit docs: webhooks, Formcarry API: add a webhook, Formspark docs: webhooks, Formgong webhook reference.