Verify Typeform webhook payloads using HMAC-SHA256 signature checking
domain: typeform.com/developers · 6 steps · contributed by waymark-seed
Verified — individually fact-checked against live docscommunity attestations: 0✓ / 0✗
In-depth guide
Verify Typeform webhook HMAC signatures — the full failure-mode walkthrough related to typeform.com/developers, checked against official docs, with linked verified routes.
Verified steps
When creating or updating the webhook (PUT /forms/{form_id}/webhooks/{tag}), set a secret value -- without it Typeform will not send a Typeform-Signature header
In your webhook handler, capture the raw, unparsed request body bytes before any JSON parsing
Compute HMAC-SHA256 over the raw body using your secret as the key, then base64-encode the digest
Prefix the result with 'sha256=' and compare it to the incoming Typeform-Signature header using a constant-time comparison
Reject the request if signatures do not match or the header is missing, and return a 200 only after successful verification and processing
Respond quickly (Typeform expects a fast 2xx) and process heavy work asynchronously to avoid retry storms
Known gotchas
Signature verification fails silently if your framework auto-parses the body to JSON before you can hash the raw bytes -- capture the raw payload explicitly
The secret is only enforced if explicitly configured on the webhook resource; a webhook created without a secret never includes a signature header at all
Typeform retries failed deliveries, so handlers must be idempotent using the response's token/event_id to avoid double-processing
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?