Vai al contenuto
Peak Atlas
Peak Forms

Peak Forms · Developers

Process responses via webhook.

Peak One sends every submission as signed JSON to your server. You verify the signature, detect duplicates by ID and process the rest as usual.

Start for freeStart for free

HMAC-SHA256, timestamp and event ID in every delivery.

One delivery

Headers and body.

The body always has the same envelope. Under data you find lead, answers, source and campaign.

Example viewPOST to your https address
Peak-Webhook-Id
Event ID, same on retry
Peak-Webhook-Timestamp
Unix seconds
Peak-Signature
t=<time>,v1=<HMAC-SHA256>
Body
{ id, type, createdAt, scope, data }

Peak One webhook format

Test deliveries also carry test: true so you can ignore them.

Eventi

Four events to subscribe to.

  • form.submitted

    Every submitted request from Forms or Pages.

  • lead.created

    A form, page or booking brought a contact.

  • lead.qualified

    A lead was marked as a fit.

  • booking.created

    A meeting via Peak Booking was confirmed.

Sample code

Verify the signature and embed.

The signed text is “<timestamp>.<raw body>” with your webhook secret. Verify on the raw body before you parse it.

Verify the signature (Node.js)
import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyPeakWebhook(secret, rawBody, header, toleranceSeconds = 300) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=", 2)));
  const t = Number(parts.t);
  if (!t || !parts.v1 || Math.abs(Date.now() / 1000 - t) > toleranceSeconds) return false;
  const want = createHmac("sha256", secret).update(`${t}.${rawBody}`).digest();
  const got = Buffer.from(parts.v1, "hex");
  return want.length === got.length && timingSafeEqual(want, got);
}
Embed a form
<iframe src="https://app.peak-atlas.com/f/<public-id>?embed=1"
  title="Kontakt" loading="lazy"
  style="width:100%;min-height:640px;border:0"
  data-peak-form="<public-id>"></iframe>

How to start

From endpoint to first delivery.

  1. Create an endpoint

    Enter a public https address. Internal addresses and IP ranges are refused.

  2. Store the secret

    Peak One creates a secret with the prefix whsec_. Keep it server-side.

  3. Send a test

    “Send test” delivers a sample event. Check signature and duplicate detection.

Frequently asked questions

How often is a webhook retried?

Up to six attempts, spread from one minute to twelve hours, always with the same ID. Respond quickly with 2xx and process asynchronously.

Does the iframe resize?

Yes, with the full embed code from Peak Forms. It contains a short script that follows the height.

Does the webhook contain all answers?

Yes, under data.answers, plus name, e-mail and campaign details where available.

Peak Forms

Build on real events.

Create a free account and send yourself the first test event.

Start for freeStart for free