Lobsite-Webhooks: webhooks from Lobsite forms

Q: How do I stop these requests?

If the site is yours, remove webhook from the form in lobsite.toml and deploy. If it isn't, answer with an error: each submission is tried 6 times in all and then dropped. If they keep coming, write to abuse@lobsite.com with the X-Lobsite-Delivery value and we'll look into it.

Requests from Lobsite-Webhooks/1 deliver form submissions from a Lobsite site to an address its owner set up. How to verify them, and how to stop them.

Lobsite-Webhooks is the user agent of the webhooks Lobsite sends. A Lobsite site with a form can send each submission to a webhook address its owner set in lobsite.toml, and these requests are those deliveries. If you see it in your logs, someone pointed a form's webhook at your server: usually you, from your own Lobsite site.

What a request looks like

Each accepted, non-spam form submission is one POST with a JSON body:

POST /hooks/contact HTTP/1.1
Content-Type: application/json
User-Agent: Lobsite-Webhooks/1
X-Lobsite-Event: form.submission
X-Lobsite-Delivery: dlv_3m9q…
X-Lobsite-Signature: t=1760372438,v1=5257a869…

{
  "type": "form.submission",
  "id": "sub_8x2k…",
  "site": "quiet-fox-4821",
  "form": "contact",
  "data": { "email": "ana@example.com", "message": "Hi!" },
  "created_at": "2026-10-13T16:20:38Z"
}

Webhooks only go to https:// addresses that don't resolve to private or internal networks.

Check that a request is really from Lobsite

The user agent can be faked; the signature can't. X-Lobsite-Signature has a timestamp t and v1, the hex HMAC-SHA256 of "<t>.<raw body>" with the form's webhook secret, shown once in the Lobsite dashboard. Compute the same value from the raw body, compare in constant time, and reject a t older than 5 minutes.

import { createHmac, timingSafeEqual } from "node:crypto";

function verified(secret, header, rawBody) {
  const { t, v1 } = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  if (Math.abs(Date.now() / 1000 - Number(t)) > 300) return false;
  const expected = createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");
  return v1?.length === expected.length && timingSafeEqual(Buffer.from(v1), Buffer.from(expected));
}

Retries

A 2xx answer within 10 seconds counts as delivered. Anything else is tried again 5 times: after 1 minute, 5 minutes, 30 minutes, 2 hours and 12 hours. X-Lobsite-Delivery stays the same across the retries, so you can skip a delivery you've already handled.

Frequently asked questions

How do I stop these requests?

If the site is yours, remove webhook from the form in lobsite.toml and deploy. If it isn't, answer with an error: each submission is tried 6 times in all and then dropped. If they keep coming, write to abuse@lobsite.com with the X-Lobsite-Delivery value and we'll look into it.

Which plans send webhooks?

Webhooks are part of the Standard plan. Sites on the free plan get email notifications instead. See the forms docs.

Why do I get the same submission twice?

Your server answered too slowly or with an error the first time, so it was retried. Skip deliveries whose X-Lobsite-Delivery you've seen.

Lobsite-Webhooks