Configure
- Open `/integrations` as an owner or admin.
- Create a CRM webhook with an HTTPS URL.
- Add a signing secret if the receiver can verify HMAC signatures.
- Click Test and confirm the destination receives `webhook.test`.
- Capture a test lead and confirm the destination receives `lead.created`.
Verify signatures
import crypto from "node:crypto";
function validSignature(rawBody, secret, received) {
const expected = crypto
.createHmac("sha256", secret)
.update(rawBody)
.digest("hex");
return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(received));
}