Yes, HeyLead can send every lead to your own endpoint. Add an HTTPS URL, choose events (lead.created, lead.updated or site.alert), and HeyLead posts JSON with the lead's contact details, form answers and first- and last-touch source, signed with HMAC-SHA256 so you can verify it came from HeyLead.
Setup
Updated
In HeyLead open Integrations → Webhooks, add your https:// endpoint and choose the events to send.
Copy the signing secret (it starts with whsec_).
Verify the x-heylead-signature header against the raw request body, then process the lead:
import crypto from "node:crypto";
function isFromHeyLead(rawBody, header, secret) {
const expected =
"sha256=" + crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
return header?.length === expected.length &&
crypto.timingSafeEqual(Buffer.from(header), Buffer.from(expected));
}Done. Your endpoint receives every lead with its source.
Dashboard tour
A one-minute tour of the HeyLead dashboard: the channel, campaign and full journey behind every lead you send to Webhooks.
See all featuresA common setup: Webhooks → Next.js → Salesforce.
How teams like yours use HeyLead with Webhooks.
lead.created when a new lead arrives, lead.updated when its status or details change, and site.alert when a site stops sending data.
Compute an HMAC-SHA256 of the raw request body with your whsec_ secret and compare it with the x-heylead-signature header, which looks like sha256=<hex>.
No. Each event is sent once. The lead is always saved in HeyLead, so you can export anything your endpoint missed.
No. Webhook URLs must use https so lead data is encrypted in transit.
Get started
Connect your website in minutes. From then on, every new lead shows which ad, search, post or AI assistant brought it.