Integrations & webhooks

A connection is where forms send data when something happens: a Zapier catch hook, a Slack channel, or any HTTPS endpoint you run. Deliveries are queued rows first and network calls second — retried with backoff, visible in a log, and impossible for a rolled-back save to have fired.

Connections and slugs

Create a connection under Integrations in the sidebar, paste the destination URL, and reference the connection from rules and workflow actions by its slug — never by URL. The URL is a credential and is never echoed back by any API; a shared form resolves the slug in the submitting organisation, so your partner's crm fires their connection, not yours.

What a delivery carries

Zapier and webhook deliveries POST a JSON envelope: an eventId to deduplicate on (delivery is at-least-once), the eventType (submission.created, submission.updated, submission.transitioned), the form, the submission's data and computed values, and — for transitions — which state it left and entered. Slack deliveries fold the same envelope into a short channel message at the last moment; the stored row keeps the full envelope either way.

Verifying a webhook delivery

Zapier and webhook connections are signed. Each request carries:

X-Faldaro-Signature: t=1755600000,v1=<hex hmac>
X-Faldaro-Event-Id: 4f6c…
X-Faldaro-Delivery-Attempt: 1

The signature is HMAC-SHA256, keyed with the signing secret shown once when the connection was created, over the string <t>.<raw body>. To verify: read t and v1 from the header, compute HMAC_SHA256(secret, t + "." + body) over the raw bytes you received, and compare constant-time. Refuse a t more than a few minutes old — the timestamp is the replay defence.

# Node
const [t, v1] = sig.split(',').map(p => p.split('=')[1]);
const expect = crypto.createHmac('sha256', secret)
  .update(`${t}.${rawBody}`).digest('hex');
crypto.timingSafeEqual(Buffer.from(v1), Buffer.from(expect));

Retries and failure

A failed delivery retries on an exponential backoff with jitter, up to six attempts. A 4xx answer other than 408/429 is terminal — the endpoint said the request itself is wrong, and the row records the endpoint's own words. Every delivery, sent or failed, is a row on the connection's delivery log.

Operator allow-lists

The server only ever connects to hosts an operator has allow-listed — hooks.zapier.com and hooks.slack.com by default, and nothing for generic webhooks until WEBHOOK_ALLOWED_HOSTS names your endpoints. HTTPS only, resolved addresses checked, redirects never followed: a form author must not be able to make the platform issue requests to arbitrary places.

Everything on this page is Faldaro calling out. For mail coming in — a forwarded message becoming a submission on a form's own address — see Email-to-form; for an AI client calling in to operate your account, see the MCP server.