Webhooks

curl --request POST https://api.onlyform.com/v1/webhooks \
  --header "X-API-Key: $ONLYFORM_API_KEY" \
  --header "Content-Type: application/json" \
  --data '{
    "form_id": "507f1f77bcf86cd799439011",
    "url": "https://example.com/webhooks/onlyform",
    "enabled": true,
    "signing_secret": "replace-with-a-long-random-secret"
  }'

{
  "id": "a1b2c3d4",
  "response": {
    "formId": "507f1f77bcf86cd799439011",
    "answers": {
      "customer-email": "[email protected]"
    }
  }
}

Content-Type: application/json
User-Agent: Onlyform Webhook
Onlyform-Version: 1.0.0
Onlyform-Signature: sha256=<hex digest>

import { createHmac, timingSafeEqual } from 'node:crypto'

export function verifyOnlyformWebhook(rawBody, signature, secret) {
  if (!signature?.startsWith('sha256=')) return false

  const expected = `sha256=${createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex')}`

  const actualBuffer = Buffer.from(signature)
  const expectedBuffer = Buffer.from(expected)

  return actualBuffer.length === expectedBuffer.length
    && timingSafeEqual(actualBuffer, expectedBuffer)
}