A response comes in.
Give it a next step.

Start with a test response.

1. Publish a small form using synthetic answers. Note its question IDs: webhook answers are keyed by question ID, not question label.
2. Create the provider webhook below. Add its exact HTTPS URL in your form's webhook settings and save the signing secret shown once at creation. Keep the URL and secret in restricted configuration.
3. Use a public HTTPS receiver on port 443. Redirects and private/reserved DNS answers are rejected. Cloudflare-proxied receivers require operator-configured authenticated egress or a supported DNS-only HTTPS relay; ask your operator if registration reports an unsupported host.

FlexGather signs every attempt and includes the same event ID in the JSON body's id, X-FlexGather-Event-Id, and Idempotency-Key. That ID stays stable on retry and manual replay; the signature timestamp is refreshed. A different endpoint has its own event ID for the same submission.

Verify before taking action.

Map four Code inputs: rawBody from the untouched request text, signature from X-FlexGather-Signature, eventId from X-FlexGather-Event-Id, and secret from your saved endpoint secret. Header names are case-insensitive. Use this JavaScript in Code by Zapier; in Make Code, change the first line as shown.

const fields = inputData // In Make Code, use: const fields = input
const { createHmac, timingSafeEqual } = require('crypto')
const { rawBody, signature, eventId, secret } = fields
if ([rawBody, signature, eventId, secret].some((v) => typeof v !== 'string' || !v)) {
  throw new Error('Missing verification input')
}
const match = /^t=(\d{1,12}),v1=([0-9a-f]{64})$/.exec(signature)
if (!match) throw new Error('Invalid signature format')
if (Math.abs(Math.floor(Date.now() / 1000) - Number(match[1])) > 300) {
  throw new Error('Signature outside five-minute tolerance')
}
const expected = createHmac('sha256', secret)
  .update(match[1] + '.' + rawBody, 'utf8').digest()
const supplied = Buffer.from(match[2], 'hex')
if (supplied.length !== expected.length || !timingSafeEqual(supplied, expected)) {
  throw new Error('Invalid signature')
}
const event = JSON.parse(rawBody)
if (event.type !== 'form.submitted' || event.id !== eventId || !event.data?.submissionId) {
  throw new Error('Unexpected event or mismatched event ID')
}
return {
  eventId: event.id,
  submissionId: event.data.submissionId,
  submittedAt: event.data.submittedAt,
  answers: event.data.answers,
  score: event.data.score
}

The signature covers the timestamp, a dot, and the exact UTF-8 body. Do not parse/re-serialize JSON, trim the body, or remove the secret's prefix before verification. Let an error stop the workflow. Restrict access to Code inputs, run histories, and exports because they can expose secrets.

Old editor samples and long queues can exceed the five-minute tolerance. Send a fresh response or replay in FlexGather. For longer queues, verify at your own HTTPS relay before enqueueing and persist a trusted receipt. Do not remove the timestamp check.

Make: add a spreadsheet row.

1. Add Webhooks → Custom webhook. Enable JSON pass-through and Get request headers in advanced settings. Copy the URL without extra query parameters. FlexGather does not add Make's optional x-make-apikey header.
2. Register the URL in FlexGather, select Run once in Make, and submit the published form. Add Make Code → Run code → JavaScript and use the verifier above with its four inputs.
3. Enable Process data in order. Check a Make Data store for the verified eventId. Route already-completed IDs to a no-action path.
4. For new IDs, use Google Sheets → Add a Row. Map eventId, submissionId, submittedAt, and the selected answers by their actual question IDs. After success, store the event ID and returned row reference in the Data store.
5. Activate the scenario. Open the actual spreadsheet and match its event ID to the FlexGather delivery. Replay that delivery and confirm no second row is added in the ordinary sequential replay test.

Make Code is currently a paid-plan open-beta feature; Make documents a 5 MB webhook limit. A Data store check is best-effort deduplication: a crash between adding the row and saving completion can still duplicate it. For stronger guarantees, use an idempotent destination API or relay with an atomic unique event-ID claim.

Zapier: notify a team channel.

1. Select Webhooks by Zapier → Catch Raw Hook. Use Raw Hook so you receive the unparsed body and headers. Register its URL in FlexGather and submit a fresh synthetic response.
2. Add Code by Zapier → JavaScript, map the four Input Data fields, and use the verifier above. Map later actions from its verified outputs.
3. Use Storage by Zapier → Get Value with an action-specific key such as flexgather:slack:<eventId>. Add a Filter that continues only when no completed value exists.
4. Use Slack → Send Channel Message with an authorized test channel. Include the event ID and submission ID for tracing. After success, use Storage's Set Value to record completion and the message reference.
5. Enable the Zap. Inspect Zap history and open the actual Slack message. Replay the FlexGather delivery and check there is still one message; a new submission should create a new event ID and message.

Catch Raw Hook has a documented 2 MB limit. Plan access and quotas vary. Storage Get/Set is not an atomic claim: concurrent runs or a failure before Set Value can duplicate a Slack message. Use a transactional receiver and idempotent downstream action when that distinction matters.

Check the outcome, not just the acknowledgement.

A delivered status means the receiver returned HTTP 2xx. Make and Zapier can acknowledge a queue before verification or the action finishes. Check the provider run and the destination row/message. Recover failed provider steps there, or replay after correcting the issue. Keep deduplication records for as long as you allow replays.

These instructions are based on current provider documentation and local transport/signature simulator checks. Real Make/Zapier account execution, field mappings, plan access, and downstream actions still require your own verification. They are not a claim of provider certification or an already-tested connection to your accounts.