What header carries the webhook signature?
Maxforms uses a webhook-signature style header when signing is enabled.
Webhook security
Verify Maxforms webhook signatures before trusting events
When a webhook endpoint changes business data, the receiver should verify the request. Maxforms supports signed webhook payloads so your app can check the signature before processing submissions or payment-related events.
Why it helps
Cleaner workflows from the first form
Use the right feature deliberately so the form is easier to complete, easier to manage, and easier to connect to the rest of your work.
- Confirm that incoming webhook requests were signed with the shared secret.
- Reject unsigned or invalid requests before they touch downstream systems.
- Use timestamped Standard Webhooks style signature headers.
- Treat signature verification as part of production endpoint readiness.
Workflow
How teams use it
- Enable request signing in the webhook integration.
- Store the generated secret in your receiving app.
- Recreate the expected signature from the received payload.
- Compare signatures securely and process only valid requests.
FAQ
Common questions
Should test endpoints verify signatures too?
It is best to test signature verification before production so deployment does not depend on unverified webhook data.
Ready to transform your forms?
Stop rebuilding forms on every project. Install MaxForms and start collecting submissions in minutes.