# Webhooks

MuxForms webhooks POST JSON to your HTTPS URL when a submission is stored. Each form has one endpoint and a whsec signing secret; verify the MuxForms-Signature header with HMAC-SHA256. Failed deliveries retry with backoff and appear in the dashboard log.

## Webhook delivery

| Item | Value |
| --- | --- |
| Event | submission.created |
| Method | POST |
| Signature header | MuxForms-Signature (t=, v1=) |
| Retries | 3 attempts (0s, 2s, 5s backoff) |
| Configure | Dashboard → form → Integrations tab (Custom URL) |

## Setup

In the dashboard, open a form → **Webhooks**, save an HTTPS URL, and copy the signing secret.

## Signature

Header: `MuxForms-Signature: t=<unix>,v1=<hex>`

HMAC-SHA256 over `{timestamp}.{rawBody}` with your whsec signing secret. Reject timestamps older than 5 minutes.

## Retries

Up to 3 attempts with backoff (0s, 2s, 5s). Failed runs appear in the delivery log; use **Resend** to replay a submission.

Full guide: https://www.muxforms.com/docs/webhooks

## FAQ

### Where do I get the signing secret?

It is shown in the Webhooks tab after you save a URL. Rotate it there if it leaks.

### What HTTP status should my endpoint return?

Any 2xx response counts as success. Other codes trigger retries.

### Can I replay an old submission?

Yes. Use Resend on a row in the delivery log to POST the same payload again.

### Do webhooks replace email?

No. Email notifications and webhooks are independent per form.

---

HTML version: https://www.muxforms.com/docs/webhooks
Source: MuxForms (https://www.muxforms.com)