Webhooks & API

A Portal's Webhooks page holds the outbound signup webhook. The org API keys for the inbound External API live in workspace settings, under Settings > API.

Signup webhook

POSTs a notification to your endpoint once per end user, the first time they sign in to your organization, when that first sign-in happens at this Portal (with a one-time code or signed sign-in) - the moment to sync the new contact into your CRM or kick off your own onboarding. Someone who already signed in at another of your Portals is not new, so it does not fire again.

1. On the Portal's Webhooks page, enter your endpoint URL, save, and switch on Enabled.
2. On first enable, FormWise generates a signing secret, shown exactly once - store it like a password.
3. Use Send test to fire a test delivery at your endpoint.

Verifying deliveries

Every delivery is signed so you can verify it came from FormWise:

• X-FormWise-Timestamp - unix seconds when the request was signed.
• X-FormWise-Signature - sha256=<hex>, an HMAC-SHA256 over "{timestamp}.{raw body}" using your signing secret.

Recompute the HMAC over the exact raw body, compare with a constant-time comparison, and reject stale timestamps to prevent replays. Failed deliveries are retried automatically with increasing backoff, up to four attempts in total.

Payload

{
  "event": "end_user.signup",
  "toolsetId": "…",
  "toolsetName": "…",
  "organizationId": "…",
  "endUser": { "id": "…", "email": "jane@example.com", "createdAt": "…", "fullName": null },
  "timestamp": "2026-10-01T12:00:00.000Z"
}

toolsetId and toolsetName identify where the visitor signed in; for a sign-in at the Portal itself they carry the Portal's ID and name. fullName is usually null, because the webhook fires before onboarding collects a name.

Provisioning API

Settings > API hosts the API keys and Provisioning API cards (the Portal's Webhooks page links there):

• Create and revoke organization API keys (fw_live_..., secret shown once). Keys are org-wide - they work across every Portal.
• See the endpoint shape, your plan IDs, and a request example.

With a key, your systems can create end-user accounts, assign plans and access grants, and read usage - the bring-your-own-billing recipe: charge the customer in your own stack, then POST /api/v1/end-users, and they sign in with their email. Full reference: API Reference.