Webhooks

A webhook is a URL that receives data. Each lead that matches the automation is sent to your URL as a JSON POST: the person, their company, the pages they saw and the lead link. Tools like Make, n8n and Zapier give you such a URL in one click, so you need no code of your own. Once your website has a signing secret, every request is signed so you can check it came from us.

1. Automations → New automation. Pick the source, the filter and the frequency, then the action Trigger webhook.
2. Paste your URL and choose: every lead, or only leads with a suggested contact. Sample payload shows the JSON you will receive.
3. Send test webhook to check your endpoint answers, then Save & activate. Saved without a successful test, the automation is kept paused until you test it.

Verify the signatureCopy Anchor Link

1. In the webhook step, click Generate signing secret and copy it. There is one secret per website, shared by all its webhook automations; Regenerate replaces it, and the old one stops working at once.
2. Each request then carries two headers: X-Platform-Timestamp (Unix seconds) and X-Platform-Signature, the hex HMAC-SHA256 of timestamp + "." + raw request body, keyed with your secret.
3. On your server, compute the same value from the raw body (before parsing it) and compare. Refuse requests older than 5 minutes to stop replays.

import crypto from 'node:crypto';

function isFromUs(rawBody, headers, secret) {
  const ts = headers['x-platform-timestamp'];
  const expected = crypto.createHmac('sha256', secret).update(`${ts}.${rawBody}`).digest('hex');
  const given = Buffer.from(headers['x-platform-signature'] || '');
  const fresh = Math.abs(Date.now() / 1000 - Number(ts)) < 300;
  return fresh && given.length === expected.length && crypto.timingSafeEqual(given, Buffer.from(expected));
}

Without a secret, requests are sent unsigned.

The older website-wide webhookCopy Anchor Link

Accounts set up before automations may still have one webhook for the whole website, under Websites → your website → Webhook. It keeps sending every new lead to its URL. A Trigger webhook automation does the same with filters, a schedule, a signing secret and a run history, so set one up and clear the old URL when you move over. The URL must be a public http(s) address; local or private ones are refused.

Common questionsCopy Anchor Link

Can I use a webhook without writing code? Yes. In Make, n8n or Zapier create a webhook trigger, copy the URL it gives you and paste it here. Send a test lead so the tool learns the fields, then build the rest of your flow there.

What does "only leads with a suggested contact" mean? Every lead is a company; most also come with the exact person who visited. Choose this option to receive only leads that have a person attached, so your flow always has a name and email to work with.

Why did my webhook fail? Your URL answered with an error or did not answer. Open the run history: each failed run shows the reason. Fix the endpoint, then Retry this lead. The URL must be a public http(s) address; a local or private one is refused.

Does it run on old leads? Only on leads that arrive after you save it, unless you choose Retrigger for existing leads right after saving, or tick leads on the Leads page and Retrigger. Build an automation.

Do webhooks run on a trial? Yes, on every plan. When the trial or credits run out, new leads stop; the webhook keeps running on the leads you have.