# Typeform webhook trigger

> Run a workflow when a Typeform response is submitted: per-form setup, the response payload, and signature verification.

Source: https://cotera.co/docs/reference/webhooks/typeform

---

Run a workflow when someone submits a Typeform — route the lead, score the feedback, kick off follow-up. The form response becomes the workflow's input.

For behavior shared by every provider (the delivery URL, testing), see the [webhook triggers reference](https://cotera.co/docs/reference/webhooks.md).

## Prerequisites

Typeform webhooks are **auto-registered**: Cotera creates the webhook for you over Typeform's API, using a connected Typeform access token. Without one, install fails with `typeform_credentials_missing`.

## Setup

1. Add a **From an app** trigger and pick **Typeform**.
2. Set the **form ID** of the form whose responses you want.
3. Save. Cotera registers a webhook on that form, pointed at the trigger's unique URL.

Deleting the trigger removes the webhook from the form. A trigger is identified by its form, so two triggers on different forms stay distinct.

## Events

| Event key       | Fires when                    | Config              |
| --------------- | ----------------------------- | ------------------- |
| `form_response` | A respondent submits the form | `formId` (required) |

## Payload

The Typeform response payload is passed through as the workflow input:

```json
{
  "event_id": "01F1EXAMPLE",
  "event_type": "form_response",
  "form_response": {
    "form_id": "abc123",
    "token": "tok_EXAMPLE",
    "submitted_at": "2023-07-15T10:30:00Z",
    "definition": {
      "id": "abc123",
      "title": "Customer feedback",
      "fields": [{ "id": "q1", "title": "How satisfied are you?", "type": "rating" }]
    },
    "answers": [{ "field": { "id": "q1", "type": "rating" }, "type": "number", "number": 5 }]
  }
}
```

| Field                                  | Description                                                   |
| -------------------------------------- | ------------------------------------------------------------- |
| `event_id`                             | The event's unique id, used to deduplicate retries.           |
| `event_type`                           | The event type — `form_response`.                             |
| `form_response.form_id`                | The form the response belongs to.                             |
| `form_response.token` / `submitted_at` | The response's unique token and submission time.              |
| `form_response.definition`             | The form definition — its title and field list.               |
| `form_response.answers`                | The submitted answers, each tying a `field` to a typed value. |

## Signature verification

Typeform signs each delivery with the `Typeform-Signature` header in the form `sha256=<base64>` — a base64 HMAC-SHA256 of the raw request body. The signing secret is the one Cotera set when it created the webhook, so there's no per-trigger secret for you to manage. Cotera verifies it on every delivery and rejects anything that fails.