Webflow webhook payload example (form_submission)

Webflow · event: form_submission · content type: application/json

This is a representative sample — fake IDs, real structure. To see a payload with your data, point the provider at a capture URL (button below).

See it live, not frozen

One click creates a free capture bin with this exact payload already in it — pretty-printed, headers inspectable, replayable to your own endpoint:

Then paste the bin's URL into Webflow's webhook settings to capture a real delivery. No signup.

Headers

content-type: application/json
x-webflow-timestamp: 1788099916204
x-webflow-signature: 062c514e1af98e1056493b09da0ad976e700cc276cd4471f16925c1fafabbeb4

Body

{
  "triggerType": "form_submission",
  "payload": {
    "name": "Contact Us",
    "siteId": "65427cf400e02b306eaa049c",
    "data": {
      "First Name": "Zaphod",
      "Last Name": "Beeblebrox",
      "email": "zaphod@heartofgold.ai",
      "Phone Number": 15550000000
    },
    "schema": [
      {
        "fieldName": "First Name",
        "fieldType": "FormTextInput",
        "fieldElementId": "285042f7-d554-dc7f-102c-aa10d6a2d2c4"
      },
      {
        "fieldName": "email",
        "fieldType": "FormTextInput",
        "fieldElementId": "285042f7-d554-dc7f-102c-aa10d6a2d2c6"
      }
    ],
    "submittedAt": "2026-08-30T14:25:16.117Z",
    "id": "68b2f5dcdf3949bfc6752327",
    "formId": "65429eadebe8a9f3a30f62d0",
    "formElementId": "4e038d2c-6a1e-4953-7be9-a59a2b453177"
  }
}

Things that bite people

This example's signature actually verifies: x-webflow-signature = hex HMAC-SHA256 over timestamp + ":" + rawBody (colon-joined), key = the OAuth app's client secret — sample here: hookden_webflow_sample_client_secret. Site-token webhooks created after 2025-04-14 get their own per-webhook secret instead. Try the signature debugger (Webflow provider) or set the Webflow scheme on a capture bin for live ✓/✗ badges.
Dashboard webhooks send no signature at all. Webflow's docs say it plainly: webhooks created through the site dashboard "will not include the request headers needed to validate request signatures". If x-webflow-signature is missing, that's not an attack — it's how the webhook was created. Recreate it via the API/OAuth app to get signed deliveries.
The timestamp is MILLISECONDS. Webflow's replay-window sample computes currentTime - timestamp > 300000 — code that treats x-webflow-timestamp as unix seconds rejects every delivery (or accepts week-old ones). Same family of bug as WorkOS's ms timestamps; the colon separator is the other classic miss.
Redirects count as failures. Non-200 response, redirect, SSL negotiation problem, or a slow response — all failures; retried 3× at 10-minute intervals, then the delivery is gone. Repeated failure gets the webhook deactivated with an email notification, and reactivation goes through Webflow support — don't 301 your webhook path.
Form field names arrive as the display labels ("First Name", "Phone Number" — spaces included) keyed under payload.data, with the field schema alongside; there's no form-field ID keying, so renaming a form field silently renames your JSON keys. triggerType tells you which of the 14 event types fired; 75 webhooks max per trigger type.

Send it yourself

Reproduce this delivery against any endpoint (your handler, a bin, staging):

$ curl -X POST https://your-endpoint.example/hook \
  -H 'content-type: application/json' \
  -H 'x-webflow-timestamp: 1788099916204' \
  -H 'x-webflow-signature: 062c514e1af98e1056493b09da0ad976e700cc276cd4471f16925c1fafabbeb4' \
 -d '{
  "triggerType": "form_submission",
  "payload": {
    "name": "Contact Us",
    "siteId": "65427cf400e02b306eaa049c",
    "data": {
      "First Name": "Zaphod",
      "Last Name": "Beeblebrox",
      "email": "zaphod@heartofgold.ai",
      "Phone Number": 15550000000
    },
    "schema": [
      {
        "fieldName": "First Name",
        "fieldType": "FormTextInput",
        "fieldElementId": "285042f7-d554-dc7f-102c-aa10d6a2d2c4"
      },
      {
        "fieldName": "email",
        "fieldType": "FormTextInput",
        "fieldElementId": "285042f7-d554-dc7f-102c-aa10d6a2d2c6"
      }
    ],
    "submittedAt": "2026-08-30T14:25:16.117Z",
    "id": "68b2f5dcdf3949bfc6752327",
    "formId": "65429eadebe8a9f3a30f62d0",
    "formElementId": "4e038d2c-6a1e-4953-7be9-a59a2b453177"
  }
}'

← All payload examples · Signature debugger · Docs