One signed webhook. Clean JSON, keyed by your own Fields.

An Integration is an HTTPS endpoint you add in Vink and attach to one or more Forms. When a Document of that Form is approved, by a person or by Auto-Send, Vink sends one Delivery to each attached Integration.

The body is the Payload: the Document's values keyed by the Form's own Fields, inside a small envelope. Every request is signed, so your receiver can check that Vink sent it.

Vink reads PDFs with Gemini on Vertex AI, EU region.

Getting documents in

Documents come in through the app today: upload several PDFs at once, or email them in. No code? Point any system's email at the Form's Intake Address, and each PDF attachment becomes a Document. There is no upload API yet. Need one? Tell us.

This is a real Payload from a demo Form called Invoices, with a List Field for the invoice lines. The keys under data are your own Field keys, so every Form has its own shape.

{
  "event": "document.approved",
  "deliveryId": "dlv_3f6c2a1e-8b4d-4e2f-9a71-5c0d8e7b2f14",
  "test": false,
  "document": {
    "id": "k97d4m2x8q1v6c3n5b0e7h9r2t4w8a1f",
    "filename": "invoice-F-2026-0418.pdf",
    "uploadedAt": "2026-09-30T08:12:04.000Z"
  },
  "form": {
    "id": "jd72k9m3x5q8v1c4n6b0e3h7r2t9w5as",
    "version": 3
  },
  "approval": {
    "mode": "manual",
    "by": "k1754bq2m9x6c8v3n0b5e7h1r4t2w6yd",
    "at": "2026-09-30T08:14:51.000Z"
  },
  "data": {
    "supplier_name": "Drukkerij Hoekstra B.V.",
    "invoice_number": "F-2026-0418",
    "invoice_date": "2026-09-14",
    "purchase_order": null,
    "total_excl_vat": 1240,
    "vat_amount": 260.4,
    "iban": "NL91ABNA0417164300",
    "paid": false,
    "lines": [
      {
        "description": "Flyers A5, 5,000",
        "quantity": 5000,
        "amount": 740
      },
      {
        "description": "Posters A2, 200",
        "quantity": 200,
        "amount": 500
      }
    ],
    "credit_notes": []
  }
}

Each request carries a header with a timestamp and an HMAC-SHA256 signature. Every Integration has its own secret, starting with whsec_. You find it on the Integration in the app.

X-Vink-Signature: t=1790757291,v1=5257a869e7ecebeda32affa62cdca3fa51cad7e77a0e56ff536d0ce8e108d8bd

To verify a request

1. Split the header on commas and read t (Unix seconds) and v1 (hex).
2. Compute HMAC-SHA256 with your secret over the string {t}.{rawBody}: the timestamp, a dot, and the raw request body exactly as received.
3. Compare your result with v1 using a constant-time comparison.
4. Reject the request if t is more than 5 minutes away from your clock. This stops a captured request from being replayed.

Use the raw body bytes. Parsing and re-serialising the JSON changes whitespace and key order, and the signature no longer matches.

import crypto from "node:crypto";

const TOLERANCE_SECONDS = 5 * 60;

// rawBody: the request body exactly as received (a Buffer or string),
// before any JSON parsing. With Express: express.raw({ type: "application/json" }).
export function verifyVink(rawBody, header, secret) {
  const parts = Object.fromEntries(
    (header ?? "").split(",").map((part) => part.trim().split("=", 2)),
  );
  const timestamp = Number(parts.t);
  if (!Number.isInteger(timestamp) || !parts.v1) return false;

  const age = Math.abs(Date.now() / 1000 - timestamp);
  if (age > TOLERANCE_SECONDS) return false;

  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${timestamp}.`)
    .update(rawBody)
    .digest();
  const received = Buffer.from(parts.v1, "hex");
  return received.length === expected.length && crypto.timingSafeEqual(received, expected);
}

// if (!verifyVink(req.body, req.get("X-Vink-Signature"), process.env.VINK_SECRET)) {
//   return res.status(401).end();
// }

import hashlib
import hmac
import time

TOLERANCE_SECONDS = 5 * 60


def verify_vink(raw_body: bytes, header: str, secret: str) -> bool:
    """raw_body: the request body exactly as received, before JSON parsing."""
    parts = dict(p.strip().split("=", 1) for p in (header or "").split(",") if "=" in p)
    try:
        timestamp = int(parts["t"])
        received = parts["v1"]
    except (KeyError, ValueError):
        return False

    if abs(time.time() - timestamp) > TOLERANCE_SECONDS:
        return False

    signed = f"{timestamp}.".encode() + raw_body
    expected = hmac.new(secret.encode(), signed, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, received)


# Flask: verify_vink(request.get_data(), request.headers.get("X-Vink-Signature"), SECRET)

<?php

const TOLERANCE_SECONDS = 5 * 60;

// $rawBody: the request body exactly as received, before json_decode.
function verify_vink(string $rawBody, ?string $header, string $secret): bool
{
    $parts = [];
    foreach (explode(',', $header ?? '') as $part) {
        [$key, $value] = array_pad(explode('=', trim($part), 2), 2, null);
        $parts[$key] = $value;
    }
    if (!isset($parts['t'], $parts['v1']) || !ctype_digit($parts['t'])) {
        return false;
    }

    $timestamp = (int) $parts['t'];
    if (abs(time() - $timestamp) > TOLERANCE_SECONDS) {
        return false;
    }

    $expected = hash_hmac('sha256', $timestamp . '.' . $rawBody, $secret);
    return hash_equals($expected, $parts['v1']);
}

// $ok = verify_vink(file_get_contents('php://input'), $_SERVER['HTTP_X_VINK_SIGNATURE'] ?? null, $secret);

Vink waits up to 15 seconds for your answer.

A Retry-After header (seconds or an HTTP date) is honoured, up to 24 hours.

Redirects are not followed. Your endpoint must use HTTPS.

Delivery is at-least-once. The same Delivery can arrive twice, for example when your receiver saved it but timed out before answering. Store deliveryId and skip one you have already handled.

Headers

You can add your own headers to an Integration, such as an API key or Basic auth. Mark a header as secret and its value is stored encrypted and only shown masked afterwards. Vink sets Content-Type and X-Vink-Signature itself.

From an Integration, send a test to your endpoint before any real Document goes out. Choose example values for every Field, or empty values so your receiver sees null and []. You can also send an approved Document again as a test.

A test carries "test": true, is signed like a real one and is never a Delivery: it isn't retried and doesn't appear in a Document's Delivery log. The answer from your endpoint is shown right away.

No developer, or no time? Rob builds the connection for you.

A one-off build, never part of a plan. Rob writes the receiver that takes the Payload into your system, whether that is an ERP, an accounting package, a spreadsheet or a database, and sets up your Forms with you.

Ask about a connection

Tell us a little about your system and documents. Rob replies personally.