Answers with
somewhere to go.

The connected route: a signed webhook.

1. Prepare an HTTPS receiver. Use an endpoint you control, or a webhook receiver provided by your automation service. Keep the URL private.
2. Configure the form's webhook. In the form's Connections tab, enter the destination and connect it. Copy the generated signing secret shown after creation into your server's secret manager; it is not shown in the endpoint list. Treat it like a password.
3. Submit sample answers through the published form. Check the response inbox and the webhook delivery result, then inspect the receiver's payload.
4. Verify before acting. A custom receiver should check the signature against the exact raw request body. Use the payload's event or response identifier to avoid processing a delivery twice.
5. Map and test the next step. Select the fields your workflow needs, keep unnecessary personal information out, and test the destination action.

For a custom receiver.

The preview sends a JSON POST with event type form.submitted. Its X-FlexGather-Signature header contains t=timestamp,v1=hex. Calculate HMAC-SHA256 with your signing secret over the timestamp, a period, and the exact raw request body. Compare the hexadecimal digest in constant time, reject stale timestamps using a suitable tolerance, and deduplicate on the event ID before creating downstream effects.

The event ID is also sent as X-FlexGather-Event-Id and Idempotency-Key. It stays stable across replays. Preview contracts may change; verify the current implementation before connecting a production receiver.

Using Make or Zapier.

In Make, start with Webhooks → Custom webhook. In Zapier, start with a Webhooks by Zapier catch trigger. Copy the HTTPS receiver URL into FlexGather's webhook configuration, send a test submission, then map the captured fields to your next action.

These are generic webhook workflows, not native FlexGather apps. Provider account, plan, and webhook limits may apply. If a hosted receiver can't verify the signing header and raw body, add a verification endpoint you control before it; don't assume the provider automatically checks FlexGather signatures.

Google Sheets, Slack, and HubSpot.

Open your form’s Connect tab to see available native providers. Authorize a connection, choose its destination, and map your questions to the fields you want to send. Delivery logs and replay help you follow the handoff. Each provider needs an administrator-configured OAuth application; an unconfigured provider is shown as unavailable.

For your own tools, create a scoped, expiring API key in developer settings. Keys belong to your organization and can be restricted to selected forms, then revoked when you no longer need them.

Before you switch it on.

• Use sample data for preview testing and never paste real response payloads into public debugging services.
• Keep endpoint URLs and signing secrets out of browser code and published documents.
• Confirm the current signature format and event fields from the implementation before building a custom receiver; preview interfaces may change.
• Review failed deliveries before retrying, and make downstream actions safe to repeat.