Send signed webhooks.

Set up the webhook.

1. 01
   Step 1.

   Open Email in the sidebar. On a phone, tap More, then Email under Organisation. The page is titled Email and webhook.

   Email
2. 02
   Step 2.

   In the Webhook panel, paste your address into Webhook address. It must start with https and cannot hold a user name or password. An address on a private network is refused.

3. 03
   Step 3.

   Press Save webhook. The first save creates the signing secret and shows it once under Signing secret. Press Copy and store it in your receiver. It is not shown again.

   Save webhook
4. 04
   Step 4.

   Press Send test. It posts your newest lead again as a lead.resend event and tells you what your receiver answered, for example Delivered. The receiver answered with a success status.

   Send test
5. 05
   Step 5.

   Look at Last 20 deliveries. Each row shows Queued, Event, Status, Attempts and Detail.

Verify the signature.

Every request carries a header X-Cardsite-Signature that looks like t=1791956798,v1= followed by hex. Build the text of the timestamp, a dot and the raw request body. Compute its HMAC-SHA256 with your signing secret, write it as hex and compare it with v1 in constant time. Do this on the raw bytes before you parse the JSON, and reject a timestamp more than 5 minutes from your clock. A second header, X-Cardsite-Delivery, holds the delivery id. It stays the same across retries, so use it to de-duplicate.

Answers and retries.

A 2xx answer finishes the delivery. A 429, a 5xx, a network error or no answer within 10 seconds is retried, up to 8 attempts, waiting 2, 4, 8, 16, 32 and then 60 minutes. Any other answer, such as 400 or 404, or a redirect, stops it as failed. Fix the receiver and press Retry in the list. After 8 failed attempts a delivery shows as dead. A single lead can also be sent again from its page with Resend webhook.