Wiring a Form Submission to a Webhook

Forms on a Piskes site can now push every submission straight to a URL you control — a webhook — so a lead doesn't have to sit in the site dashboard until someone remembers to check it.

Setting it up

From Site → Messages, add a webhook URL. The first time you do, Piskes generates a secret unique to your site. From then on, every form submission is POSTed to your URL as JSON, signed with that secret using HMAC-SHA256 and sent in an X-Webhook-Signature header. On your receiving end, recomputing that signature against the raw body is how you confirm a request actually came from your site and not from someone who found the URL and is sending fabricated form data at it.

What's checked before it's accepted

The webhook URL has to be a real, public https:// address — Piskes actively checks this both when you save the URL and again each time a submission tries to send, rejecting anything that resolves to a private or internal address. That check exists because the URL comes out of a settings form filled in by whoever administers the site, and a URL field that only checked for https:// used to let through addresses pointing back at internal infrastructure.

What it isn't

This is a single, direct delivery — no retry queue, no per-form routing to different endpoints. For a site owner wiring form leads into a CRM, a Slack channel, or a simple internal tool, that's the whole gap this closes: submissions no longer live only inside the dashboard.