Send form submissions to Zapier

Zapier connects to thousands of apps, so it's a quick way to get Ikiform submissions into a CRM, a help desk or an email tool without writing a server. This guide catches the raw delivery, verifies it in a Code step, and only lets real submissions through.

What you'll build

• A Zap triggered by Webhooks by Zapier with the Catch Raw Hook event.
• A Code by Zapier step that checks Ikiform's signature and splits the fields into plain values.
• A Filter step, so only verified submissions reach your actions.

Before you start

• An Ikiform form that already receives submissions.
• A Zapier plan that includes webhooks. Webhooks by Zapier isn't available on the Free plan.

What Ikiform sends

Every delivery is a POST with a JSON body. The body has the same shape for every endpoint, and you can't change it. A submission looks like this:

{
  "id": "dlv_01k7v2d4n8r2p6s0w3y5b7c9e1",
  "type": "submission.created",
  "timestamp": "2026-10-23T12:00:00.000Z",
  "api_version": "2026-10-17",
  "data": {
    "submission_id": "sub_01k7v2c9t3e8m5q4x6z0a1b2c3",
    "form": { "id": "frm_xxxxxxxxxxxxxxxx", "name": "Contact" },
    "fields": { "name": "Ada", "email": "ada@example.com", "message": "Hello" },
    "meta": {
      "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)",
      "origin": "https://example.com",
      "referrer": "https://example.com/contact",
      "country": "GB",
      "subject": null,
      "reply_to": "ada@example.com"
    },
    "created_at": "2026-10-23T12:00:00.000Z",
    "truncated": false
  }
}

The form's values are in data.fields, keyed by the input name. A test from the dashboard sends an endpoint.test event instead, with data.endpoint_id and data.message and no fields. The full reference is on Webhooks.

Catch Raw Hook or Catch Hook

Catch Hook is simpler, but the Zap can't tell an Ikiform delivery from a request someone else made up. If you use it, keep the URL private and treat the data as unverified.

Set it up

1. Add the trigger

   1. Create a Zap. For the trigger, pick Webhooks by Zapier and the event Catch Raw Hook.
   2. Choose Continue until the Test tab shows the webhook URL. It looks like https://hooks.zapier.com/hooks/catch/123456/abcdef/.
   3. Copy the URL.

2. Add the endpoint in Ikiform

   • In the Ikiform dashboard, open Webhooks and choose Add endpoint.
   • Paste the Zapier webhook URL into URL.
   • Under Forms, pick one form, or All forms in the workspace.
   • Add a Description if you like, such as "Zapier", then choose Add endpoint.
   • Copy the signing secret. It starts with whsec_ and is shown in full only once.

   There's no event picker. An endpoint gets submission.created for every accepted submission on the forms you chose, and endpoint.test when you send a test. A workspace on Pro can have up to 3 endpoints.

3. Catch a real submission

   Send one submission from your form. Back in Zapier, choose Test trigger and pick the request that arrived. You should see a raw body and the request headers, including the three webhook-* headers.

   Zapier's docs don't list the exact names of the raw body and header fields, so pick them from your own test data in the next step rather than typing names by hand.

4. Verify the signature in a Code step

   Add an action: Code by Zapier, event Run Javascript. Under Input Data, add these five entries and map each one from the trigger:

   secret     whsec_paste_your_signing_secret_here
   id         the webhook-id header from the trigger
   timestamp  the webhook-timestamp header from the trigger
   signature  the webhook-signature header from the trigger
   body       the raw body from the trigger

   Paste this into Code:

   const crypto = require("crypto");
   
   const MAX_AGE_SECONDS = 600;
   
   const { secret, id, timestamp, signature, body } = inputData;
   const key = Buffer.from(String(secret).replace(/^whsec_/, ""), "base64");
   const expected = crypto.createHmac("sha256", key).update(`${id}.${timestamp}.${body}`).digest();
   const age = Math.abs(Date.now() / 1000 - Number(timestamp));
   const matches = String(signature || "")
     .split(" ")
     .some((entry) => {
       const [version, value] = entry.split(",");
       const received = Buffer.from(value || "", "base64");
       return version === "v1" && received.length === expected.length && crypto.timingSafeEqual(received, expected);
     });
   const valid = Boolean(id && timestamp && age <= MAX_AGE_SECONDS && matches);
   const event = valid ? JSON.parse(body) : null;
   const fields = event && event.type === "submission.created" ? event.data.fields : {};
   
   const text = (value) => {
     if (value === null || value === undefined) return "";
     if (Array.isArray(value)) return value.map(text).join(", ");
     if (typeof value === "object") return JSON.stringify(value);
     return String(value);
   };
   
   output = {
     valid,
     type: event ? event.type : "",
     delivery_id: event ? event.id : "",
     form: event && event.data.form ? event.data.form.name : "",
     submission_id: event && event.data.submission_id ? event.data.submission_id : "",
     ...Object.fromEntries(Object.entries(fields).map(([name, value]) => [`field_${name}`, text(value)])),
   };

   1. Read webhook-id, webhook-timestamp and the raw body exactly as received.
   2. Reject the request if the timestamp is more than 10 min from now.
   3. Base64-decode the part of the secret after whsec_ and use it as the HMAC key.
   4. Compute HMAC-SHA256 of id.timestamp.body and base64-encode it.
   5. Compare it, in constant time, with each v1 value in webhook-signature. There are two while a secret rotates.
   6. If one matches: valid: true, fields split into field_*.
   7. If none match: valid: false, the filter stops the zap.

   • The HMAC uses the raw body exactly as Ikiform sent it, so the comparison holds byte for byte.
   • valid is true only when a v1 signature matches and the timestamp is recent. The check allows 10 minutes, a little more than usual, because Zapier can hold a request for a moment before it runs the Zap.
   • Each form field becomes its own output, such as field_email and field_message, ready to map in later steps.

   Zapier passes every Input Data value as a string, and anyone who can edit the Zap can read the secret. Keep the Zap in a folder only your team can open.

5. Only continue if valid

   1. Add a Filter step after the Code step.
   2. Condition one: valid (Boolean) is true.
   3. Condition two, with And: type (Text) exactly matches submission.created.

   The second condition stops dashboard test events, which carry no fields, from reaching your actions.

6. Add your actions and publish

   Add the actions you want, such as creating a contact or posting a message, and map field_email, field_name and the rest from the Code step. Then publish the Zap. A Zap that is off answers 404, which Ikiform retries.

Ikiform only delivers to public https:// URLs on port 443. IP addresses, localhost, internal hostnames, workers.dev and pages.dev are refused when you save the endpoint.

Test it

Open the endpoint in Ikiform and choose Send test. Ikiform sends one endpoint.test event with no retries, and the result shows up in the endpoint's delivery log within a few seconds. Then send a real submission from your form, or from a terminal:

curl https://ikiform.com/f/frm_xxxxxxxxxxxxxxxx \
  -H "Content-Type: application/json" \
  -d '{"name":"Ada","email":"ada@example.com","message":"Hello from curl"}'

A 201 with "ok": true means Ikiform stored it. The delivery appears on the endpoint page, and the message lands in Zapier's Zap history.

The test event stops at the Filter step. A real submission passes the Filter and runs your actions.

How delivery works

Failed deliveries are retried 8 times over about 3 d 6 h, with the same webhook-id each time. If every delivery to an endpoint fails for 5 days, Ikiform disables it and emails the workspace owners.

Zapier always answers 200

Zapier answers every caught request with 200 before the Zap runs, and the answer can't be changed. Ikiform marks the delivery succeeded as soon as Zapier has it. If a later step fails, Ikiform doesn't retry; replay the run from Zap history instead.

Troubleshooting

Avoid duplicate records

A delivery can reach Zapier twice if an earlier attempt timed out on the way. The Code step outputs delivery_id, which stays the same across retries. Use it as a unique key in the app you write to, or look it up before you create a record.

Next steps

Zapier's own reference: Trigger Zaps from webhooks, JavaScript in Zaps and Code by Zapier rate limits.