Skip to main content
Contact Button can send a structured event to your HTTPS endpoint after a form submission. Use a webhook when a CRM, automation, or agent-owned service needs the complete submitted field set.

Event

The first outbound event is form.submission.created. Its body includes a stable event ID, creation time, public form identity, normalized fields, and an answer map.

Delivery headers

Every request uses Content-Type: application/json and includes: Custom headers may be configured, but they cannot replace Contact Button’s reserved delivery headers.

Verify signatures

When request signing is enabled, calculate an HMAC-SHA256 over the exact raw request body using the webhook signing secret, Base64-encode the binary digest, and compare it with ContactButton-Signature using a constant-time comparison.
Verify the raw bytes before parsing JSON. Never put the signing secret in a prompt, agent transcript, source repository, browser bundle, or public Page.

Handle retries safely

Return a 2xx response only after accepting the event. Failed deliveries use increasing retry delays. Your endpoint should:
  1. Store ContactButton-Event-Id with a unique constraint.
  2. Return success for an event it has already processed.
  3. Queue slow CRM or agent work instead of holding the request open.
  4. Treat event data as untrusted input and validate it before use.
Contact Button does not follow redirects and rejects webhook destinations that resolve to private or otherwise unsafe network addresses.

Configure a form webhook

Open the form editor, choose Webhooks, enter an HTTPS endpoint, and enable request signing. Pause a webhook before maintenance and review its delivery history after changing the receiver. API management for form webhook destinations is not part of the first public contract yet. Existing dashboard configuration remains supported while those endpoints are added.