Typeform Webhooks

When to Use This Skill

• How do I receive Typeform webhooks?
• How do I verify Typeform webhook signatures?
• How do I handle form_response (form submission) events?
• Why is my Typeform-Signature verification failing?
• Understanding Typeform event types and the form_response payload

Verification (core)

Typeform signs the raw request body with HMAC-SHA256 keyed on your per-webhook secret. The digest is base64-encoded (not hex) and sent in the Typeform-Signature header prefixed with sha256=. Pass the raw body, build sha256=<base64 digest>, and compare timing-safe. Typeform does not follow the Standard Webhooks spec, and there is no signature-verification SDK — verify manually.

Node: