Webhooks + DodoForm
DodoForm posts each verified record to your endpoint with an HMAC-SHA256 signature over the timestamp and body, so you can prove the request came from us before you trust it.
What happens on each record
A JSON POST to a URL you own. Each request carries an `X-DodoForm-Signature` header of the form `t=<timestamp>,v1=<hmac_sha256(t.body)>`, so your handler can verify authenticity and reject replays rather than trusting an unauthenticated POST.
The push runs after a record is approved — by the confidence gate or by a human in the review queue — so Webhooks only ever receives data that has been checked. That ordering is the point: AI-extracted values that nobody verified are worse than no values, because they are indistinguishable from real ones once they land.
What you need to connect it
Your own HTTPS endpoint plus the signing secret DodoForm shows you when you create the webhook. The secret never travels in the request.
Before you turn it on
- Verify the signature before acting on the body. An unauthenticated webhook handler is an open write endpoint for anyone who learns the URL.
- Compare the timestamp against your clock and reject old requests, which is what makes the signature replay-resistant.
- Retries are handled for you — see the retry behaviour in the API docs before building your own.
Who this is for
Engineers who want the record in their own system with no intermediary, and who would rather write one handler than maintain a Zap.