Send new leads to Zapier

Receive each new lead in Zapier with the raw body, check the signature, and pass the lead to a CRM or a spreadsheet.

Zapier is the shortest path from a Zapped lead to a CRM, a spreadsheet or a chat channel. This guide builds a Zap that receives the raw request, proves it came from Zapped, and only then creates the record.

Use this guide when

You want new leads to appear in a CRM, a spreadsheet or a chat channel, and you prefer Zapier over building a receiver yourself.

Before you start

Professional includes lead webhooks. In your Personal workspace, open Lead webhooks to configure your first destination. If a previously revoked destination is blocked, contact support to restore access.
Webhooks by Zapier needs a paid Zapier plan. Check your plan before you start.
Decide where the lead should end up. This guide uses a contact in a CRM as the example.

Steps

In Zapier, create a Zap and choose Webhooks by Zapier as the trigger. Choose the Catch Raw Hook event, not Catch Hook. Catch Hook parses the body, and a parsed body can never match the signature.
Copy the webhook address Zapier shows you.
Open Account, then Lead webhooks, paste the address into Configure destination, tick the confirmation and choose Save destination.
Copy the signing secret shown once. It starts with whsec_ and is never shown again.
In Zapier, add a Code by Zapier step in JavaScript and add five inputs: the raw body, the three request headers webhook-id, webhook-timestamp and webhook-signature, and the signing secret. Zapier lists the trigger fields it received when you click into each input.

Paste this code into the Code step. It answers verified true only when the timestamp is fresh and the signature matches the raw body.

const crypto = require('crypto');
const secret = String(inputData.signing_secret || '');
const key = Buffer.from(secret.slice(6), 'base64');
const id = String(inputData.webhook_id || '');
const time = String(inputData.webhook_timestamp || '');
const body = String(inputData.raw_body || '');
const nowSeconds = Math.floor(Date.now() / 1000);
const fresh = Math.abs(nowSeconds-Number(time)) <= 300;
let verified = false;
if (key.length === 32 && id && time && body && fresh) {
  const expected = crypto.createHmac('sha256', key)
    .update(id + '.' + time + '.' + body)
    .digest();
  verified = String(inputData.webhook_signature || '').split(' ').some(function (part) {
    if (part.indexOf('v1,') !== 0) return false;
    const given = Buffer.from(part.slice(3), 'base64');
    return given.length === expected.length && crypto.timingSafeEqual(given, expected);
  });
}
return { verified: verified, event_id: id };

Add a Filter step straight after the Code step. Continue only when verified is true. Everything after this filter is safe to run, because an unverified request never gets past it.
Add your destination action, for example Create or Update Contact in your CRM. Map the fields from the lead body.
Request one test from the Test history tab in Zapped and watch the Zap. The code step should return verified true and the Zap should continue. The test carries invented values and null identifiers, so route it to a test path or turn the Zap off again afterwards.
Capture one lead through your own published card to confirm the whole path, then check the record your action created.

Zapier answers 200 as soon as it receives the request, before your later steps run. A 2xx in Lead history means Zapier accepted the request, not that the CRM record exists. Check the Zap's task history for that. A request that your own filter or gate rejects still reaches Zapped as Delivered, because the tool answered before it decided. Lead history tells you the request arrived, not that it was trusted. Use the tool's own history to see whether your check passed.

Which fields to map

The Code step receives the body as text. To read fields in later steps, add a second Code step that parses it, or use Zapier's Formatter by Zapier step with the Transform action and the Parse JSON option. Then map the fields you need.

The lead is under data.lead, the card that captured it is under data.card, the consent is under data.consent, and the answers to your own questions are under data.custom_fields. A missing answer arrives as null.

If you want the answers to your custom questions as one line for a note or a message, read data.custom_fields.answers, which is a list. Each entry has question_label and either value or selected_options.

The developer guide at /api-documentation/lead-webhooks documents every header, every payload field, the retry table, the test event and ready made PHP and Node.js verification snippets.

Stopping duplicates

Zapier may see the same event twice, because a retry or a replay keeps the same event id. Choose one of two approaches.

Let the destination decide: actions such as Create or Update Contact and Find or Create Row look for an existing record and update it instead of adding a second one. This is the simplest option and it also protects you from a visitor sending the form twice.

Or remember the event id: add a Storage by Zapier step that reads a value keyed by the event id, a Filter that continues only when nothing was found, and a Storage step that writes the event id. Treat a stored event id as already handled.

Different cards, different handling

data.card.id tells you which card captured the lead, and data.card.name gives its name. Use a Filter or Paths step to send leads from one card to one owner or one pipeline.

Remember that a test event has a null card id, so a rule built on a card id will not match a test. Test the card rule with a real lead from that card.

What Zapier does with a bad request

If your Zap is switched off or deleted, Zapier answers 404, and Zapped records a failed delivery that is not retried. Turn the Zap on again and request a replay from Lead history.

Zapier can also accept a request with 200 and process it several minutes later when it is busy. That is expected and does not need a retry.

Plans and availability

Lead webhooks are included with Professional. Open Account, then Lead webhooks, and save your HTTPS destination to get started. Delivery begins only after you configure a destination and the service is available. Custom-plan access follows your agreement.

Good ways to use this

Put the verification Code step and the Filter first, so no unverified request ever reaches your CRM.
Keep the signing secret in the Code step's input, not inside the code text, so you can replace it without editing the code.
Use Create or Update Contact rather than Create Contact, so a visitor who sends the form twice becomes one contact.
Switch the Zap on only after the test event passes the filter.

Common questions

Why Catch Raw Hook and not Catch Hook?

Catch Hook parses the request body into fields before your steps see it. The signature is computed over the exact bytes as they arrived, so a parsed body cannot match. Catch Raw Hook gives you the body unparsed and includes the request headers.

Does the Code step need a paid plan?

Code by Zapier runs on every plan, with a shorter time limit on the free plan. The trigger is the part that needs a paid plan: Webhooks by Zapier is not included on the free plan.

How do I check that verification really works?

Request one test and confirm the Zap continues. Then edit the request headers once, for example change one character of the signature, and confirm the filter stops it. Undo that change afterwards.

Where do I see what Zapier did with a lead?

Zapier's task history for the Zap shows each run and each step's result. Zapped's Lead history shows only whether the request reached Zapier.

If something looks wrong

If verified is always false, Catch Hook was chosen instead of Catch Raw Hook, or the raw body input is a parsed object rather than text. Recreate the trigger with Catch Raw Hook and map the raw body field again.
If verification fails only for real leads but passed for the test, the signing secret was replaced after you pasted it, most often by saving the destination again. Copy the current secret and update the Code step input.
If every request fails the filter, the timestamp may be read as a header name in the wrong case. Map the three headers from the trigger fields rather than typing their names by hand.
If the Zap is off, Zapier answers 404 and Zapped records a failed delivery. Switch the Zap on and request one replay from Lead history.
If the record is missing but the delivery says Delivered, open the Zap's task history. The failure is in one of your later steps.

Was this guide helpful?

Still have questions? Contact support and we'll help you out.