Tally Webhooks

When to Use This Skill

• How do I receive Tally webhooks?
• How do I verify Tally webhook signatures (the Tally-Signature header)?
• How do I handle FORM_RESPONSE form submission events?
• How do I read form answers from data.fields?
• Why is my Tally webhook signature verification failing?

Verification (core)

Tally signs webhooks with an optional signing secret. When a secret is set on the webhook, each request carries a Tally-Signature header (case-insensitive) whose value is base64(HMAC-SHA256(signingSecret, rawJsonBody)). There is no timestamp scheme and it is not the Standard Webhooks spec. Always HMAC the raw request body — re-serializing the parsed JSON can change bytes/key order and break the comparison.