Webhooks vs REST APIs for Form Submissions

Once your forms are collecting submissions, the next question is how to get that data into your own systems — a CRM, a database, a Slack channel or your app. There are two fundamental patterns: webhooks (the service pushes data to you) and REST APIs (you pull data from the service).

The short version

	Webhook	REST API
Direction	Push — the service calls you	Pull — you call the service
Timing	Real time, on each submission	Whenever you ask (e.g. every 5 minutes)
You need	A public HTTPS endpoint	Credentials and a scheduler or trigger
Best for	Instant actions and notifications	Reporting, backfills, syncing, on-demand lookups
Main risk	Missed events if your endpoint is down	Delay and wasted calls when nothing changed

How webhooks work

You give the form service a URL. Every time a submission arrives, the service sends an HTTP POST with the submission data to that URL.

Visitor submits form
        │
        ▼
Form backend ──POST (JSON)──▶ https://yourapp.com/hooks/form
                                   │
                                   ▼
                     Save to DB, notify team, add to CRM

A minimal receiver (Node.js with Express):

import express from 'express';

const app = express();
app.use(express.json());

app.post('/hooks/form', async function (req, res) {
  const submission = req.body;
  // Respond quickly, then do the slow work.
  res.sendStatus(200);
  await saveSubmission(submission);
});

app.listen(3000);

Webhook best practices

• Respond fast (within a few seconds) with a 2xx status, then process in the background. Slow endpoints cause timeouts and retries.
• Make processing idempotent — the same event may be delivered twice. Use the submission ID to ignore duplicates.
• Use HTTPS and keep the URL unguessable, or verify a signature or secret if the service provides one.
• Log failures and have a way to replay missed events.

How REST APIs work

You call the service's API with an access token and ask for submissions — for example, everything since the last time you checked.

const response = await fetch(
  'https://api.example.com/v1/forms/FORM_ID/submissions?since=' + lastSync,
  { headers: { Authorization: 'Bearer ' + process.env.FORMS_TOKEN } }
);
const { submissions } = await response.json();

REST API best practices

• Keep tokens server-side — never in browser code.
• Page through results rather than requesting everything at once.
• Respect rate limits and back off when you get a 429 response.
• Store a cursor (last ID or timestamp) so each sync picks up where it left off.

When to use which

Choose webhooks when…

• Something should happen immediately: alert sales about a hot lead, create a support ticket, send a welcome sequence.
• You're connecting to automation tools — Zapier, Make and n8n all have webhook triggers.

Choose a REST API when…

• You're building reports or dashboards that refresh on a schedule.
• You need to backfill historical submissions into a new system.
• Your system can't expose a public endpoint (behind a firewall, for example).
• You want to look up or manage data on demand.

Use both when…

Reliability matters. A common, robust pattern is: webhooks for real-time, plus a scheduled API sync that catches anything a webhook missed during downtime.

Webhooks and APIs in Formclick

• Custom webhooks (paid plans): add a URL in your form's dashboard and each new submission is sent to it. Use it to reach your CRM, database or automation tools.
• Native integrations remove the need for your own webhook receiver in many cases — Google Sheets, Notion, Airtable, Discord, email marketing tools, and direct delivery to PostgreSQL, MySQL, SQL Server, MongoDB, Supabase and Neon.
• n8n is supported natively; Zapier and Make connect through webhooks.
• A REST API with OAuth access tokens lets you read and manage forms, submissions and webhooks — it powers integrations such as the Make app. See the developer docs.

Security checklist

• HTTPS only, for both webhooks and API calls.
• Treat webhook payloads as untrusted input — validate before saving or displaying.
• Never log full personal data unnecessarily.
• Rotate tokens and webhook URLs if they leak.

For building your own receiving endpoint, see How to Build a Serverless Form Backend.