Guide
Send Sentway submissions to a webhook
A Sentway webhook posts a signed JSON body to a URL of your choosing when a visitor submits a form or passes a gate. Webhooks are how a Sentway site feeds a CRM, a spreadsheet, an automation tool or an internal service without anybody copying data by hand.
Create the webhook
Add the destination URL in the dashboard. Sentway generates a signing secret at creation time and shows it once. The URL must be a public HTTPS endpoint: Sentway resolves the hostname before every delivery and refuses private, loopback, link-local and cloud metadata addresses, at creation time and again on each send.
Verify the signature
Compute HMAC-SHA256 over the exact raw body, hex encode it, and compare against the signature header with a constant-time comparison. Parse the JSON only after the comparison passes.
Plan requirement
Webhooks are a Pro feature. Submissions are still captured and stored on the free tier; they are simply not delivered outward until the account is on Pro.
Questions
- How do I verify that a webhook request really came from Sentway?
- Every delivery carries an HMAC-SHA256 signature computed over the raw request body using the secret generated when the webhook was created. Recompute the signature over the raw bytes and compare it with a timing-safe equality check before trusting the payload.
- What happens if my endpoint is down?
- Sentway retries a failed delivery up to five times with increasing gaps between attempts. Each attempt is recorded in the delivery history so a failure is visible rather than silent.
- Which events can trigger a Sentway webhook?
- Form submissions and gate passes. Both carry the site, the visitor and the captured fields.