Verify that a webhook came from Makeform

You can reject forged Makeform webhook requests by checking the request body against its X-MakeForm-Signature header.

Makeform signs deliveries only when you set a signing secret and the request has a body.

In the web app, you open the form's Automations tab, choose Webhooks, then click Add a signing secret.

Makeform fills in the Signing Secret field.

If you created the webhook through MCP, save its generated secret from the creation response; you can't retrieve it later.

1. Read the raw request body bytes before parsing or reformatting the JSON.
2. Compute an HMAC-SHA256 digest of those bytes, using the signing secret as literal UTF-8 text. Keep any whsec_ prefix if the secret has one.
3. Encode the digest as lowercase hexadecimal. Add sha256= at the start.
4. Compare that value with the X-MakeForm-Signature header. Reject the request if they differ.

The header value looks like sha256= followed by the hex digest. If you parse and reserialize the body before checking, the values can differ.

The signature covers only the request body. It doesn't cover the timestamp or delivery ID.

It also doesn't cover the URL or other headers, so you can't use the signature alone to prevent replayed requests.

Track delivery IDs to detect repeats.

GET and HEAD webhooks have no body, so you won't receive signatures for them.

If you don't set a signing secret, Makeform sends unsigned deliveries.