Send website form submissions to your own webhook
To send website form to webhook endpoints, use Anticode’s general-purpose connector: each form sent on your published sites is posted as a small JSON document to an HTTPS address you choose. That address can be your own server, a serverless function, or an automation tool such as Zapier, Make, n8n or Pipedream. It's sent once, shortly after the visitor submits, with no retries.
The payload
Every delivery is an HTTP POST with content-type: application/json and a user agent of Anticode-Webhook/1. The body always has the same five keys:
| Key | What it holds | Example |
|---|---|---|
event | Always the string form.submitted | "form.submitted" |
site | The project's name | "Harbour Yoga" |
form | Which form: booking, contact, subscribe, signin, or fn:<name> for a custom form | "booking" |
data | The fields exactly as the visitor sent them, all strings | {"service":"Yin","day":"2026-11-02","time":"18:30","name":"…","phone":"…","email":"…"} |
submittedAt | When the form arrived, ISO 8601 in UTC | "2026-10-24T09:14:05.000Z" |
The fields in data follow the built-in forms: a booking sends service, day, time, name, phone and email; a contact form sends name, email and message; a newsletter sign-up and an invite request send email. A custom form sends its own fields. Unlike the Slack or Telegram connectors, nothing is shortened or reformatted, so your code receives the original values.
Setting it up
- Create the receiving end and copy its URL. It must start with
https://. - In the dashboard, open Connectors › Webhook, paste the URL into Webhook URL and press Save and turn on.
- Press Send a test. Your endpoint receives a contact-form body with
siteset to "Anticode test" and a sample name and message. - Answer with any 2xx status. Anything else, including a redirect, is reported as a failure that names the status.
What the URL must look like
Because Anticode's server makes the request, it checks the destination the way a careful server should: the address when you save, and the address and its DNS again at every delivery:
- HTTPS on the standard port 443, with no username or password inside the URL.
- A real public host name, not an IP address in any spelling, not
localhost, and not internal suffixes such as.local,.internal,.lanor.test. - Not an Anticode address, and not a
workers.devor Cloudflare tunnel host. Put a Worker behind your own domain instead. - Every address the name resolves to must be public, so a domain pointing at
127.0.0.1or a cloud metadata address is refused. - Redirects aren't followed. If your endpoint answers 301 or 302, update the URL to the final address.
The whole exchange has five seconds. Do slow work after you answer: accept the request, queue it, reply 200, then process.
Timing and delivery guarantees
A form post only saves the submission. A scheduled job on Anticode's server runs every minute, claims each new submission so it can't be sent twice, and delivers it to your email (if you have alerts on) and to every enabled connector. In practice your endpoint hears about a submission within about a minute.
It is sent once. If your server is down, slow or answers an error, that delivery is not retried. The submission itself is safe in the project's Submissions, where you can read or export it. If missing an event would matter, design for it: make your handler idempotent and reconcile against an export now and then.
Security on both sides
The URL is sealed with AES-256-GCM, tied to your account and this connector, and never shown again or sent to the browser. That matters because many webhook URLs carry their own secret, like a Zapier hook id or a token in the query string. Anticode doesn't sign connector deliveries or let you add headers, so if your endpoint needs to know a request is genuine, put a long random token in the URL's query string and compare it in your handler. If you need signed calls, use a site function, which sends an HMAC signature header.
Limits
- One webhook URL per account, shared by every site you publish. Route by the
sitekey on your side. - Your reply is ignored. To show something to the visitor or refuse a submission, use a site function instead.
- Submissions past a free site's monthly allowance are held and never posted.
- No delivery history or resend button: the dashboard shows the submission, not what your endpoint answered.
New to webhooks? Read what a webhook is. Specific recipes: Zapier, Make and n8n.
Questions people ask
Can I test against localhost?
No. Private and local addresses are refused. Use a public HTTPS tunnel or a request-inspection service while developing.
Is the payload signed?
No. Keep the URL secret, add a random token to it if your endpoint needs proof, or use a site function for HMAC-signed calls.
What happens if my endpoint returns 500?
That delivery is marked as failed and not retried. The submission remains in your dashboard.
Can I receive form-encoded data instead of JSON?
No. The body is always JSON with the five keys above.