Summary: Basin signs its webhooks and has real projects and an API, which makes it one of the closest comparisons. Postbag's differences are structural: every submission is a row with an outbox, streams map many forms onto one versioned schema, and the whole thing is one self-hostable container that an agent can drive from the free plan.
| Capability | Postbag | Basin |
|---|---|---|
| Free tier | 5 forms, 1,000 submissions/month, 5 destinations, 90-day retention (paid plans not yet on sale) | 1 form, 50 submissions/month, 30-day retention (Basin pricing) |
| Entry paid | Not yet on sale | Starter $12.50/month billed yearly |
| Management API | Full /v1 API for every object (forms, schemas, streams, mappings, destinations, routes, deliveries, events), OpenAPI generated from the live routes | Forms, submissions, projects, form webhooks (Growth+) |
| Webhooks | Yes, HMAC-SHA256 signed (Postbag-Signature t=…,v1=…), retried with backoff, dead-lettered and retryable | Yes, signed (X-Basin-Signature, HMAC-SHA256), Growth+ |
| Yes (Resend), Reply-To from the submission | Yes, plus SMS | |
| Chat destinations | Telegram today; Slack and Discord next | Slack, Discord |
| Spam | Honeypot, per-form rate limit, origin allowlist, Cloudflare Turnstile; spam is stored and reversible, never dropped | reCAPTCHA v2/v3, hCaptcha, Turnstile, honeypot, duplicate/country/burner-email filters |
| File uploads | Not yet (text fields only; 256 KB) | Yes |
| Self-hosting / source | Yes: one Docker image + Postgres, same image as the hosted product | No |
| Schemas and drift | Versioned, immutable form and stream schemas; observe / enforce / managed modes; drift detection and inference | Real-time email/phone validation; no versioned schemas |
| Many sites → one destination | Projects, tags, streams (many forms → one schema → one destination), delivery windows, digests | Projects, Agency plan, unlimited collaborators |
| For AI agents | llms.txt, openapi.json, GET /v1/me, POST /v1/quickstart, _test submissions with delivery ids to poll, errors with hint + docs, Idempotency-Key, if_exists: return | llms.txt; AI lead features; no MCP or CLI found |
Basin facts checked on against: usebasin.com/pricing, API reference, Webhooks (signed). Prices and quotas change; verify on their pages. Tagline quoted: "a lead-capture platform for the web" (Basin's llms.txt).
Choose Basin if
- You want SMS alerts and lead-qualification features out of the box.
- You need uploads and many captcha options.
Choose Postbag if
- You want signed webhooks and an API on the free tier.
- Many forms with different field names must arrive as one schema, with windows and digests.
- You need self-hosting or agent-driven setup.
What Postbag does differently, in one paragraph
Postbag treats a submission as a database row before anything else and delivery as an outbox drained by a worker, so every attempt is recorded and retryable and nothing is dropped, including spam. It adds streams, so many forms with different field names map onto one versioned schema and go to one partner or CRM with windows and digests. Every webhook is signed. The whole product is one API described by /openapi.json and /llms.txt, so an AI agent can create, verify and route a form without a browser. And it ships as one Docker image plus Postgres, so the hosted product and a self-hosted install are the same thing.