Send your leads anywhere with a signed webhook

What it does

• One POST per batch of up to 100 leads; every batch of a send shares a delivery_id. With "One lead per request" on, one POST per lead instead.
• X-LeadWebia-Signature: sha256=<HMAC of the raw body with your signing secret>.
• Retries on network errors, 5xx and 429; a "Send test" button posts a sample lead.
• HTTPS to public hosts only.

How the requests look

Payload and signature

Example body

{
  "event": "leads.sent",
  "sent_at": "2026-10-13T15:04:05Z",
  "source": "leadwebia",
  "delivery_id": "6f1c2a9e-0d4b-4c6e-9a51-2b7e8c1f3d20",
  "batch": { "index": 1, "count": 1 },
  "leads": [
    {
      "place_id": "ChIJ…",
      "name": "Joe's Pizza",
      "status": "Contacted",
      "score": 78,
      "score_label": "hot",
      "category": "Pizza restaurant",
      "vicinity": "1200 Congress Ave, Austin, TX 78701",
      "city": "Austin",
      "state": "TX",
      "postal_code": "78701",
      "rating": 4.6,
      "user_ratings_total": 212,
      "website": null,
      "phone": "+1 512-555-0134",
      "phone_e164": "+15125550134",
      "emails": ["hello@joespizza.com"],
      "facebook": "https://www.facebook.com/joespizza",
      "instagram": null, "linkedin": null, "twitter": null, "tiktok": null, "youtube": null,
      "performance": null, "accessibility": null, "best_practices": null, "seo": null,
      "cms": null,
      "ads": [],
      "niche": "pizza",
      "google_maps_url": "https://www.google.com/maps/place/?q=place_id:ChIJ…",
      "landing_page_url": null,
      "leadwebia_url": "https://leadwebia.com/dashboard?q=Joe%27s+Pizza&websiteFilter=all",
      "saved_at": "2026-10-12T18:30:00Z"
    }
  ]
}

Verify the signature in Node.js

// Express: keep the raw body, the signature is computed over its exact bytes.
const crypto = require('crypto');
const express = require('express');
const app = express();

app.post('/leadwebia', express.raw({ type: 'application/json' }), (req, res) => {
  const header = req.get('X-LeadWebia-Signature') || '';
  const expected = 'sha256=' + crypto
    .createHmac('sha256', process.env.LEADWEBIA_SIGNING_SECRET)
    .update(req.body)                       // Buffer with the raw body
    .digest('hex');
  const valid = header.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(header), Buffer.from(expected));
  if (!valid) return res.sendStatus(401);

  const payload = JSON.parse(req.body.toString('utf8'));
  // Optional: refuse old deliveries (replays).
  if (Date.now() - Date.parse(payload.sent_at) > 5 * 60 * 1000) return res.sendStatus(400);

  for (const lead of payload.leads) {
    // lead.place_id, lead.name, lead.phone_e164, lead.emails…
  }
  res.sendStatus(200);
});

Verify the signature in Python

# Flask: request.get_data() is the raw body the signature covers.
import hashlib
import hmac
import os

from flask import Flask, abort, request

app = Flask(__name__)
SECRET = os.environ["LEADWEBIA_SIGNING_SECRET"].encode()


@app.post("/leadwebia")
def leadwebia():
    raw = request.get_data()
    expected = "sha256=" + hmac.new(SECRET, raw, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, request.headers.get("X-LeadWebia-Signature", "")):
        abort(401)
    payload = request.get_json()
    for lead in payload["leads"]:
        ...  # lead["place_id"], lead["name"], lead["phone_e164"], lead["emails"]…
    return "", 200

Frequently asked