Signed webhooks
Send an event to your server and verify its signature before processing it.
Create the connection
- Use an HTTPS endpoint that resolves to a permitted public address.
- Generate a dedicated signing secret and store it in the receiving server's secret environment.
- Choose the form or routing rule and publish the connection.
Illustrative event
| Header / value | Meaning |
|---|---|
| X-LittleReply-Event | Event identifier |
| X-LittleReply-Timestamp | Timestamp in seconds |
| X-LittleReply-Signature | sha256= followed by the HMAC SHA-256 of timestamp + dot + raw body |
| submission.accepted | Acceptance event; does not mean email delivery |
JSON — illustrative event
{
"version": 1,
"event": "submission.accepted",
"event_id": "identifiant-unique",
"submission_id": "identifiant-de-la-demande",
"form_id": "identifiant-du-formulaire",
"created_at": "2026-10-14T12:00:00Z",
"fields": {
"name": "Taylor",
"message": "Product question"
}
}Verify before side effects
Check the signature against the raw body, reject stale or replayed events, and make the receiver idempotent using the event identifier.
Documentation reviewed on October 20, 2026Suggest an improvement →