Connect
Send every lead to your own systems.Signed, retried and logged.
One address per organisation, an HMAC signature on every request, and a delivery list you can retry from.
POST https://hooks.yourcompany.com/leads
content-type: application/json
x-cardsite-signature: t=1791956798,v1=98f1971b62c0...
x-cardsite-delivery: 58ce6e17-825d-44c6-ae51-677ff99554b1
{ "event": "lead.created",
"name": "Mia Fischer",
"company": "Harbourline Freight",
"placement": "dw27-badge",
"score": 75, "band": "hot", "stage": "new",
"consent": true, "consentText": "I agree that..." }| Event | Status | Attempts | Detail |
|---|---|---|---|
| lead.created | done | 1 | 200 |
| meeting.created | pending | 3 | 503, next try in 8 min |
In short
A signed webhook for lead capture sends each new lead and meeting request from 1Namecard to an address you choose, as JSON. Every request carries an HMAC-SHA256 signature so your receiver can check it came from 1Namecard, and a failed delivery is retried for about three hours before it is marked dead. Any receiver that accepts a POST works.
Last updated
What it does.
Send three events.
lead.createdandmeeting.createdgo out when a visitor's form is saved.lead.resendgoes out when an admin presses Send test or Resend webhook. Honeypot hits, duplicates within 24 hours and failed saves send nothing.Build the body when it is sent.
The JSON holds the card, name, company, e-mail, phone, note, consent and its wording, placement, actions, score, band and stage, plus the organisation, event, delivery id and attempt. A meeting adds day, time, time zone, UTC start and end, and topic. IP address, user agent and internal notes are never included.
Sign every request.
The
X-Cardsite-Signatureheader readst=<unix>,v1=<hex>.v1is the HMAC-SHA256 of<t>.<raw body>, keyed with your signing secret. Reject a timestamp more than five minutes off, to stop replays.Give every delivery an id.
X-Cardsite-DeliveryequalsdeliveryIdin the body and stays the same across retries. A delivery can arrive twice, so de-duplicate on it.Retry on a schedule.
Answer within 10 seconds. A 2xx is done. A 429, a 5xx or a timeout is retried after 2, 4, 8, 16, 32 and then 60 minutes, up to 8 attempts, then marked dead. Any other 4xx fails at once.
List the last 20 deliveries.
The Email and webhook page shows status, attempts and the error for each, with Retry on failed and dead ones. A single lead has its own Resend webhook button.
Refuse unsafe addresses.
The address must be https and, in production, cannot point at a private network. Redirects are not followed. Rotate secret makes a new secret, shown once, and the old one stops working at once.
about 3 h
of retries before a delivery is marked dead
20
latest deliveries in the list
How it works in three steps.
Step 01
Paste your address.
Open Email and webhook (under Email in the sidebar), enter the Webhook address and press Save webhook. Copy the signing secret. It is shown once.
Step 02
Verify and answer.
In your receiver, recompute the HMAC over the raw body, compare in constant time, store the delivery id and answer 200 within 10 seconds.
Step 03
Send a test.
Press Send test. It posts your newest lead again as
lead.resendand shows what your receiver answered.
Who it is for.
Teams on another CRM
You want leads in a CRM with no native connection yet.
Operations and automation owners
You route leads to a sheet, queue or chat tool.
Developers
You want one POST, one signature and one id.
Limits by plan.
- Included: Every plan has webhooks. Each organisation has one address and one signing secret.
- Included: The list shows the last 20 deliveries. Finished jobs are deleted after 30 days.
What it does not do yet.
- Not included: Only new submissions are sent. Stage, note and owner changes are not, so it is a feed, not a pipeline sync.
- Not included: There is one address per organisation, with no routing by card or event.
- Not included: Salesforce, Pipedrive, Microsoft Dynamics 365 Sales and Zoho CRM native integrations are in development. See the roadmap. HubSpot already has a native sync.
Send leads to Zapier or Make with a catch webhook.
These are not native integrations. Any tool that can catch a webhook works the same way: Zapier-style tools, Make, n8n or your own server. Create a catch trigger, paste its address into Webhook address, press Send test so the tool sees a real payload, then build the steps.
- Create or update a contact by
email. - Use
name,company,band,scoreandplacementin the record. - Keep
consent, the wording andreceivedAtas the consent record.
Do not paste a Slack address here, because Slack expects a different body. Use the built-in Slack message under lead alerts.
What happens on each answer from your receiver.
| Your receiver answers | What happens |
|---|---|
| 2xx | Done. |
| 429, 5xx, no connection or no answer in 10 seconds | Retried up to 8 attempts, then dead |
| 3xx or any other 4xx | Failed at once. Fix the receiver and press Retry |
The queue is worked every 5 minutes, so a retry can land up to 5 minutes late. Stored errors hold a status code or error name, never the body.
Questions about this feature.
How do I verify the signature?
Read t and v1 from the X-Cardsite-Signature header. Compute an HMAC-SHA256 of t, a full stop and the raw body with your signing secret, and compare it to v1 in constant time. Reject a timestamp over five minutes old.
What if my server is down?
It is retried after 2, 4, 8, 16, 32 and 60 minutes, up to eight attempts, about three hours in all. Then it is marked dead and waits for you to press Retry.
Can I send leads to Zapier or Make?
Yes, as a generic webhook. Create a catch trigger in the tool, paste its address and press Send test. It is not a native integration. Any receiver that accepts a POST works.
Can the same lead arrive twice?
Yes, after a retry or a resend. The delivery id and the lead id are stable, so use either to de-duplicate.
Does the webhook include IP addresses?
No. It never includes the IP address, user agent, internal notes or the lead's owner.