Stored form, missing CRM record
A saved Formstack submission does not prove the external sales system accepted the mapped contact.
Formstack Forms CRM delivery
Make every Formstack submission a verified CRM handoff.
Protect Formstack Forms webhooks with HMAC verification, approved JSON field mapping, stable submission identity, duplicate-safe retries, and a destination receipt.
Paid plan uses secure Stripe checkout · plan assigned after verified payment · activate with the checkout email- 25live deliveries
- 14 daysproduction access
- No cardto start
- Real APInot a demo
A successful automation run is not proof of delivery.
Formstack can save a submission and send it to an external URL while the receiving integration or later CRM write still fails. A dependable handoff must authenticate the webhook, keep the source submission identity through recovery, and record the final destination outcome.
Formstack Forms submission -> HMAC-verifying adapter -> LeadProof -> CRM, workflow, or sales queueUnauthenticated ingress
Accepting a form webhook before checking its HMAC signature allows untrusted requests into the lead workflow.
Unsafe recovery
Replaying a failed downstream request without the original submission identity can create duplicate contacts or tasks.
Implementation
Put LeadProof in the delivery path.
Keep the tools that create and process the lead. Standardize only the fragile handoff between them.
Platform reference: Formstack: WebHook Submit Actions ↗Open sandbox instructions →- Configure a Formstack Forms WebHook Submit Action for JSON delivery to a public HTTPS receiving adapter.
- Set an HMAC secret, verify the signature from X-FS-Signature or the configured custom HMAC header, and reject invalid requests before mapping fields.
- Use the Formstack submission identifier as the LeadProof Idempotency-Key and send only approved contact and routing fields to the authorized destination.
- Store the LeadProof receipt beside the Formstack submission so operators can reconcile, alert, and replay without creating another CRM record.
POST
https://leadproof.jessesay.chatgpt.site/api/v1/leadsAuthorization: Bearer lp_live_your_key
Idempotency-Key: stable-source-lead-id
Content-Type: application/json
{
"destination": "https://your-crm.example/webhook",
"name": "Alex Morgan",
"email": "alex@example.com",
"source": "formstack forms"
}Questions
What teams ask before adding LeadProof.
Does LeadProof need the Formstack HMAC secret?
No. Keep the HMAC secret inside the receiving adapter or secret manager. LeadProof receives the normalized delivery request and public HTTPS destination, not the Formstack secret.
Can Formstack send JSON?
Yes. Formstack documents JSON and URL-encoded webhook content types. JSON is a clear choice for a receiving adapter that validates and maps named fields.
Should file uploads be forwarded to the CRM?
Only when the destination is explicitly authorized for them. A lead-delivery workflow should otherwise send the minimum approved contact and routing fields rather than copying form files.
See the gaps in your real workflow.
Get an explainable risk score, prioritized fixes, and the right LeadProof plan.