Tally webhook to Make: map fields by name instead of position, and check that the request really came from your form
Short answer
Tally sends every answer as a list of fields, so a Make scenario that maps fields[1], fields[2] breaks silently the day someone moves a question. Map by label instead with first(map(1.data.fields; "value"; "label"; "Email")), or by the field key when labels change. To reject requests that did not come from your form, add a secret custom header in Tally and a Make filter that checks it, or verify Tally's HMAC signature (tally.so/help/webhooks, checked 2026-10-05).
Map Tally webhook fields in Make by label or key so moving a question cannot break the sheet, and reject requests that did not come from your form.
Disclosure: links marked "paid link" pay us a commission from the vendor if you sign up. Your price is unchanged, and every file here works without them. How we choose tools →
Every Tally automation on this site starts the same way: the form posts to a Make webhook, and Make writes the answer into a Google Sheet, mapping answers by position: the first field into the name column, the second into the phone column. Move a question, or add one above the others, and the phone number lands in the email column. The scenario still runs green. Nobody notices for a week.
This page fixes that, and the second weakness of a webhook address: anyone who finds it can post to it.
The free lead capture chain this page hardensTally form → Google Sheets → Telegram alert, with three free blueprints
What Tally actually sends
Tally posts one JSON body per submission: an event id, the event type FORM_RESPONSE, a timestamp, and a data object whose fields list holds one item per question, each with a key, a label, a type and a value (tally.so/help/webhooks, checked 2026-10-05). The key looks like question_3EKz4n; the label is the question text; the value depends on the type.
| Field type | What value holds | What to map in Make |
|---|---|---|
| Short answer, email, phone, number, date | A single value | The value directly |
| Multiple choice, dropdown | A list of option ids, not the option text | The option text from the field's options list, matched by id |
| Checkboxes | A list of option ids | Same as above, one entry per ticked box |
| Hidden field (e.g. source) | The value from the page link | The value directly |
Three ways to pick a field, compared
| Method | Formula in a Make field | Breaks when |
|---|---|---|
| By position (our blueprints today) | {{1.data.fields[3].value}} | A question is moved, added above, or removed |
| By label | {{first(map(1.data.fields; "value"; "label"; "Email"))}} | The question text is edited |
| By key | {{first(map(1.data.fields; "value"; "key"; "question_3EKz4n"))}} | The question is deleted and recreated |
map() takes a list, the property to return, and optionally a property and value to filter on (Make Help Center, array functions, checked 2026-10-05). So map(1.data.fields; "value"; "label"; "Email") returns the value of every field labelled Email, and first() takes it out of the list. The answer to the Make community question on dynamic Tally fields (December 2025) recommends the same: it does not care where the question sits.
Label or key? Use the label when you own the form and rarely rename questions; it is readable. Use the key when others edit or translate the form. Tally does not document whether a key survives every edit, so after any big change, submit a test and check the row.
Switch one of our blueprints to label mapping
- Import the blueprint, for example the Tally lead alert below, and open the Google Sheets "Add a Row" module.
- In the name column, replace {{1.data.fields[1].value}} with {{first(map(1.data.fields; "value"; "label"; "Name"))}}, using your question text exactly, including capitals.
- Do the same for every column, and in the Telegram module for every field the message uses.
- Click Run once and submit the form. Check each cell of the new row against what you typed.
- Now move a question in the Tally editor, publish, and submit again. The row should be identical. That test is the whole point of the change.
Tally form → lead log → Telegram alert. The free version of the lead alert
No website form, no CRM, no paid tool. A free Tally form posts to Make; the lead lands in Google Sheets and Telegram pings sales in seconds.
Get all 23 blueprints in one ZIP, by email
Choice fields need one more step: their value is an option id. Match it against the field's options list to get the text; the Make community thread linked below includes a working scenario. Or make the question a short-answer field.
The form these blueprints are built on; webhooks, hidden fields and the signing secret are free (tally.so/help/webhooks, checked 2026-10-05): Create a free form → paid link · we earn a commissionPaid link. If you ever upgrade to a paid plan through it we earn a commission from Tally; your price is the same, and the free plan covers every automation here.
Check that the request came from your form
A Make webhook address is a long random URL. That is the only protection it has. If it leaks, in a screenshot, a shared scenario or a browser history, anyone can post a fake lead and the sheet and Telegram will accept it. Tally gives you two ways to prove a request is genuine.
Option 1: a secret header and a filter (simple)
- In Tally, open the form's Integrations tab, edit the webhook, and add a custom HTTP header: name X-Form-Key, value a long random string you generate once.
- In Make, open the webhook module, show the advanced settings and switch on Get request headers. The headers then arrive as a list of name and value items.
- Click the link between the webhook and the next module, add a filter, and set the condition: {{first(map(1.__IMTHEADERS__; "value"; "name"; "x-form-key"))}} equals your random string. Write the header name in lowercase, as the forum examples do.
- Submit the form: it passes. A post from anywhere else stops at the filter.
Option 2: Tally's signature (stronger)
With a signing secret set, Tally adds a Tally-Signature header to every request: an HMAC-SHA256 of the payload with your secret, in base64 (tally.so/help/webhooks, checked 2026-10-05). Make's sha256 function returns an HMAC when given a key and can output base64 (Make Help Center, checked 2026-10-05). The signature covers the raw body, so the webhook must pass it through as text (JSON pass-through), and a Parse JSON module turns it back into fields: one more module per run. Use it when the form collects anything sensitive.
What it costs
Label mapping and the header filter cost nothing extra: they are formulas and a filter, not modules. The lead alert stays at 3 credits per lead, about 300 a month at 100 leads, inside the Free plan's 1,000 credits and two active scenarios (make.com/pricing, checked 2026-10-05). Signature verification with a Parse JSON module adds 1 credit per lead.
Estimate the credits for your lead volumePick the automations, type your leads a month, see the credits and the plan that fits
Every Tally blueprint here runs on Make's free plan at small-business volume; when you need more scenarios, this is our link: Sign up (one month of Core free) → paid link · we earn a commissionPaid link. If you sign up through it we earn a commission from Make; your price is the same, and the link gives you one month of Core free.
Not sure which automation comes first?Answer a few questions; get the automations in order, with the credits each one uses
What does not work
- A label with a comma. The fourth argument of map() accepts several values separated by commas, so a label such as "Name, surname" is read as two labels. Rename the question, or map by key.
- Two questions with the same label. map() returns both values and first() quietly takes one. Keep labels unique within a form.
- Tally retries. Without a 2XX answer within 10 seconds, Tally retries after 5 minutes, 30 minutes, 1 hour, 6 hours and 1 day (tally.so/help/webhooks, checked 2026-10-05), so a slow scenario can log a lead twice.
- Option 1 is a shared secret, not a signature: anyone who can open the Tally settings or the Make filter sees it.
- Our published blueprints still map by position, because a label-mapped file only works with our exact question texts. The switch is yours to make after import.
How do I get a Tally field by name in Make?
Use {{first(map(1.data.fields; "value"; "label"; "Your question"))}} in any field of the next module. map() returns the value of every field whose label matches, and first() takes the single result out of the list.
Why does my dropdown answer show a long id instead of the text?
Tally sends choice answers as option ids, together with an options list of ids and texts (tally.so/help/webhooks, checked 2026-10-05). Match the id against the options list, or use a short-answer field if the text is all you need.
Are Tally webhooks free?
Yes. Tally's help centre says webhooks are available for free to all Tally users; the signing secret and custom headers are settings of the same webhook (checked 2026-10-05).
Can I verify the Tally-Signature header in Make?
Yes: pass the raw JSON through, compare sha256 of it (your signing secret as the key, base64 output) with the header, then parse the JSON. Test with a real submission first.
- Tally Help — Webhooks (payload: key, label, type, value; option ids; signing secret and Tally-Signature; custom headers; retries; free for all users; checked 2026-10-05)
- Make Help Center — Array functions (map, first; checked 2026-10-05)
- Make Help Center — Text and binary functions (sha256 with an HMAC key; hex, base64 or latin1 output; checked 2026-10-05)
- Make Apps Documentation — Webhooks (Custom webhook advanced settings: JSON pass-through, Get request headers; checked 2026-10-05)
- Make Community — "How can I extract dynamic Tally fields into variables from a webhook payload?" (December 2025)
- Make Community — "Get a value from a webhook header" (map over the headers list by name)
- Make — Pricing (Free: 1,000 credits, 2 active scenarios; checked 2026-10-05)
Related guides
Next step
All automations →
LEAD ALERTLead comes in → logged → alert. No hands.
A form on the client site sends a lead; it is logged and an alert reaches Telegram in seconds. The first automation every consultant sets up.
DUPLICATE CHECKReturning lead → recognised → "second contact", not "new lead"
A returning lead is greeted as new. Before logging, the phone is checked against the log; if it is there, the alert says "came back", not "new lead".
MISSING INFOForm arrives incomplete → an email asking for exactly what is missing
A lead without a phone, an order without an address. Instead of someone chasing, one email lists the missing fields; the lead is logged as "incomplete".
Get one new Make automation each week
Get the full 23-blueprint pack (ZIP) by email, then one new automation a week. Every build on the site stays open and free without it.