Airtable Setup Guide
Follow these 6 steps to activate your DangWire automation on Airtable.
Create Your Airtable Account
Sign up for free at airtable.com. The free tier includes unlimited bases with 1,000 records each — enough for testing and small operations.
Connect Airtable in DangWire
In your DangWire dashboard, open Settings → Integrations, select Airtable, and click Connect. Authorize the base you want form submissions written to.
Map Form Fields to Columns
Match each form field to the target column in your base. Attachments, links, and rich field types are supported — every mapping is labeled in the connector.
Receive Purchased Automations by Email
Automations purchased from the DangWire marketplace arrive by email with the workflow JSON. Import or reference it to extend the base with the delivered flow.
Test with a Sample Submission
Submit a test form and confirm the record appears in your base with every field — including attachments — correctly populated.
Go Live
Once the test record looks right, the connection is live: every new form submission creates a record in Airtable automatically.
Airtable status callbacks (optional)
Ask Airtable to POST build and delivery status back to DangWire so your order progress updates in real time. Callbacks are authenticated — unauthenticated requests are rejected in production.
- 1
Point Airtable at the callback URL
Configure the webhook or HTTP action to POST to:
https://dangwire.com/platform-callbacks/airtable - 2
Authenticate the callback
Add a custom header to the webhook or HTTP action request — every Airtable HTTP step supports custom headers:
X-Webhook-Secret: <your secret>Your secret is any long random string you choose (keep it identical on both sides).
- 3
Mirror the secret on DangWire
Set
AIRTABLE_WEBHOOK_SECRETto the same value. Leave it unset on local dev (callbacks are accepted with a warning); production rejects callbacks without it.
Verify webhook signatures
Every forward DangWire sends to your automation URL is HMAC-signed so you can prove it came from us and was not tampered with in transit. The dashboard Test button sends the exact same signed shape, so you can validate your verification logic before going live. Verification is optional — unsigned requests are still delivered — but recommended for production endpoints.
| Header | Meaning |
|---|---|
X-Webhook-Signature | Hex-encoded HMAC-SHA256 digest over `{timestamp}.{raw_body}` using your workflow's signing secret. |
X-Webhook-Timestamp | Unix seconds (string) when the request was signed. Reject anything older than 5 minutes to block replays. |
X-Webhook-Event | Event type — `form_submission` for live submissions and manual test probes alike. |
Verification recipe
- Read the raw request body before JSON parsing — the signature covers the exact bytes on the wire.
- Compute
expected = HMAC_SHA256(secret, timestamp + "." + raw_body)and compare it toX-Webhook-Signaturein constant time. - Reject when
X-Webhook-Timestampis more than 5 minutes old (replay window) or the digest does not match.
import { createHmac, timingSafeEqual } from "crypto";
function verifyDangWire(secret, rawBody, timestamp, signature) {
const expected = createHmac("sha256", secret)
.update(timestamp + "." + rawBody)
.digest("hex");
const ok = timingSafeEqual(
Buffer.from(expected, "hex"),
Buffer.from(signature, "hex"),
);
const fresh = Math.abs(Date.now() / 1000 - Number(timestamp)) <= 300;
return ok && fresh;
}Your signing secret (whsec_…) is per workflow. Read it once from the dashboard integration settings or the management API (GET /api/webhook-signing/workflows/<id>), store it in your platform's credential vault, and rotate it there when needed (POST …/rotate) — rotation invalidates old signatures immediately.