Data out · Lead intake & webhooks
Leads come in. Your other systems stay in sync.
Incoming lead sources receive JSON or form posts at /api/webhooks/inbound/<source>, authenticated with the source API key. Map your fields, test the connection and configure first contact before enabling live intake. Website forms and external systems use the same source settings.
- 01
Incoming lead
Source key authenticates a mapped live event
- 02
CRM record
Import history stays distinct from live intake
- 03
Outgoing event
HMAC signature lets your receiver verify delivery
Before you connect
What you need ready.
- An HTTPS source or destination that you control
- A separate key for each incoming lead source
- A signing secret and event selection for outgoing subscriptions
In your workspace
What this connection makes possible.
Historical exports use the separate connector import endpoint. A configured supplier and source ID preserve attribution; records are deduplicated and conflicts held for review. Imports remain paused and do not queue outreach.
Subscribe a URL to events such as lead.created, lead.replied, lead.engaged and lead.status_changed. Each request carries an X-Webhook-Signature header — an HMAC-SHA256 of the body with your secret — so the receiver can prove it came from your install.
- Incoming JSON and HTML forms, with a separate key for each source
- Historical connector imports with replay protection and attribution review
- Per-subscription event filters, or every event
- HMAC-SHA256 signatures with a secret you choose
- Works with Zapier, Make, n8n or your own endpoint
Connect & verify
Set it up, one step at a time.
- 01
Connect an incoming source
Integrations → Webhooks → Incoming: create a source, copy its URL and key, map fields and test before enabling outreach. The website-forms guide includes examples.
- 02
Add an outgoing subscription
Integrations → Webhooks → Outgoing: URL, events and a secret.
- 03
Verify the signature
Compute HMAC-SHA256 of the raw body with the secret and compare it with X-Webhook-Signature.
Check the whole connection
Test incoming field mapping without creating a record; for outgoing events, receive a test delivery and verify its raw-body signature.
Configuration exampleView code
import crypto from 'node:crypto'
const expected = 'sha256=' + crypto
.createHmac('sha256', process.env.WEBHOOK_SECRET)
.update(rawBody)
.digest('hex')
const received = Buffer.from(req.headers['x-webhook-signature'] ?? '')
const signature = Buffer.from(expected)
const valid = received.length === signature.length
&& crypto.timingSafeEqual(signature, received)FAQ
Lead intake & webhooks questions
Are incoming and outgoing webhook credentials the same?
No. Incoming lead sources use their own API key. Outgoing event subscriptions use an HMAC signing secret. Keep both private; never use one as the other.
Will importing historical leads start a campaign?
No. Connector imports create paused records or preserve existing contact states. Review attribution, consent and your audience before explicitly launching outreach.
Build the rest of your workflow
Make it your own
Connect Lead intake & webhooks to your workspace.
Start with the installation guide, or get help connecting your own accounts.