Build a Webhook Receiver in Google Apps Script (doPost Guide)

Webhooks turn external events, Stripe payments, Shopify orders, Typeform submissions, into Sheet rows via a deployed Apps Script web app doPost endpoint.

Validate signatures before trusting bodies. Respond within provider timeouts (often 3–5 seconds) by enqueueing heavy work to Script Properties or a Queue sheet for a time-driven processor.

Read /blog/apps-script-doget-dopost-explained for HTTP method nuances and deployment ACLs.

Example code

function doPost(e) {
  const secret = PropertiesService.getScriptProperties().getProperty('WEBHOOK_SECRET');
  const sig = e.parameter.signature || (e.postData && e.postData.headers && e.postData.headers['X-Signature']);
  const body = e.postData.contents;
  const expected = Utilities.base64Encode(Utilities.computeHmacSha256Signature(body, secret));
  if (sig !== expected) {
    return ContentService.createTextOutput('unauthorized').setMimeType(ContentService.MimeType.TEXT);
  }
  const json = JSON.parse(body);
  SpreadsheetApp.openById('SHEET_ID').getSheetByName('Events').appendRow([new Date(), json.type, JSON.stringify(json)]);
  return ContentService.createTextOutput(JSON.stringify({ received: true })).setMimeType(ContentService.MimeType.JSON);
}

FAQ