Sometimes an enquiry needs to go somewhere other than your inbox — into a CRM, onto a Google Sheet, or through an automation tool like Zapier or Make. Any form can forward its submissions to an external endpoint as well as storing them here.
Destinations are approved first
Before a form can send anywhere, the destination has to be approved. Ask for one from your customer portal, under "Sending Form Submissions Elsewhere": give the address of the service and a line on what the data is for. We review each request by hand.
We do this because a webhook means your site making requests out to someone else's service from our servers, so we check what the destination is before switching it on. Approvals are per host, so approving hooks.zapier.com covers every hook you create there — you never need to re-apply when a URL changes.
Your site's form editor shows which destinations you're approved for.
Setting it up
Open the form under Forms and find Send to an External Service. You'll need:
- An endpoint URL — the address the receiving service gives you. It must start with
https://. - A payload format — JSON suits most APIs; form-encoded suits Google Apps Script.
- Headers, if the service needs authentication. This is where an API key goes.
- A field mapping, if their field names differ from yours.
Your submissions are saved either way
The submission is stored here before the forward is attempted. If the other service is down, slow, or misconfigured, you still have the lead under Forms → Submissions — nothing is lost while you sort the connection out. The visitor sees the normal thank-you either way; they're never left waiting on someone else's server.
The panel shows the result of the most recent delivery, so you can tell at a glance whether the connection is working.
Field mapping
Leave the mapping empty and every field is sent under its own name. Map even one field and only mapped fields are sent — which is a useful way to keep an internal-only field out of a third-party system.
Why your API key is safer here
It's possible to build a form by hand as a custom module and have the browser post it straight to a CRM. Don't: any key in that JavaScript is visible to every visitor in the page source, most services refuse browser requests from another site anyway, and submissions built that way skip your spam protection and are never recorded here.
A webhook sends from the server instead. The key is stored on our side, never appears in your pages, and the submission still goes through validation, spam protection and your notification email first.
What isn't allowed
Endpoints must be an approved destination, and must be public HTTPS addresses. Plain http:// is refused, because submissions can contain personal data and shouldn't travel unencrypted. Private, internal and loopback addresses are refused too. If your URL is rejected when you save, the message will say which rule it hit.
Who can configure it
Admin-role accounts only. Editors can build and edit forms, but not point one at an external service — sending data off the server is an owner's decision. See Users, Roles & Password Resets.