Send Sentway submissions to a webhook

Add the destination URL in the dashboard. Sentway generates a signing secret at creation time and shows it once. The URL must be a public HTTPS endpoint: Sentway resolves the hostname before every delivery and refuses private, loopback, link-local and cloud metadata addresses, at creation time and again on each send.

Compute HMAC-SHA256 over the exact raw body, hex encode it, and compare against the signature header with a constant-time comparison. Parse the JSON only after the comparison passes.

Webhooks are a Pro feature. Submissions are still captured and stored on the free tier; they are simply not delivered outward until the account is on Pro.

How do I verify that a webhook request really came from Sentway?

Every delivery carries an HMAC-SHA256 signature computed over the raw request body using the secret generated when the webhook was created. Recompute the signature over the raw bytes and compare it with a timing-safe equality check before trusting the payload.

What happens if my endpoint is down?

Sentway retries a failed delivery up to five times with increasing gaps between attempts. Each attempt is recorded in the delivery history so a failure is visible rather than silent.

Which events can trigger a Sentway webhook?

Form submissions and gate passes. Both carry the site, the visitor and the captured fields.

• Gate a page behind email capture
• Collect form responses and read them back
• Read visitor activity from a Sentway site