Configure

  • Open `/integrations` as an owner or admin.
  • Create a CRM webhook with an HTTPS URL.
  • Add a signing secret if the receiver can verify HMAC signatures.
  • Click Test and confirm the destination receives `webhook.test`.
  • Capture a test lead and confirm the destination receives `lead.created`.

Verify signatures

import crypto from "node:crypto";

function validSignature(rawBody, secret, received) {
  const expected = crypto
    .createHmac("sha256", secret)
    .update(rawBody)
    .digest("hex");
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(received));
}