CloseUp-CRM Lead Bridge — תיעוד

{
  "event": "lead.captured",
  "lead": {
    "name": "Dana Cohen",
    "email": "dana.cohen@example.com",
    "phone": "+972-52-555-0142"
  },
  "form": {
    "provider": "contact-form-7",
    "form_id": "412",
    "name": "Homepage — Request a demo",
    "fields": {
      "your-name": "Dana Cohen",
      "email_address": "dana.cohen@example.com",
      "tel": "+972-52-555-0142",
      "company": "Northwind Ltd.",
      "message": "Interested in the Pro plan."
    }
  },
  "attribution": {
    "utm_source": "google",
    "utm_medium": "cpc",
    "utm_campaign": "spring_demo",
    "utm_term": "wordpress crm",
    "utm_content": "hero_cta",
    "gclid": "Cj0KCQiA1234EXAMPLE",
    "fbclid": null
  },
  "enrichment": {
    "browser": "Chrome 126",
    "os": "macOS 14",
    "device": "desktop",
    "language": "en-US",
    "referrer": "https://www.google.com/",
    "page_url": "https://example.com/?utm_source=google&utm_medium=cpc"
  },
  "meta": {
    "lead_id": "9f8b7c6d-5e4a-4b3c-2d1e-0f9a8b7c6d5e",
    "source_url": "https://example.com/contact/",
    "site": "https://example.com",
    "plugin_version": "1.1.0",
    "is_test": false,
    "timestamp": "2026-07-22T09:14:07Z"
  }
}

POST /webhooks/leads HTTP/1.1
Host: crm.example.com
Content-Type: application/json
User-Agent: CloseUp-CRM-Lead-Bridge/1.1.0
X-CLL-Signature: sha256=9b2e1f0a7c... (HMAC-SHA256 of the raw body)
X-API-Key: your-shared-api-key
Authorization: Bearer your-webhook-secret

{ ...the JSON body shown above... }

<?php
// Read the RAW body exactly as received — do not decode + re-encode.
$rawBody   = file_get_contents('php://input');
$secret    = getenv('CLL_WEBHOOK_SECRET');
$header    = $_SERVER['HTTP_X_CLL_SIGNATURE'] ?? '';       // "sha256=<hmac>"
$expected  = 'sha256=' . hash_hmac('sha256', $rawBody, $secret);

if (!hash_equals($expected, $header)) {
    http_response_code(401);
    exit('Invalid signature');
}

// Optional: also require the raw API key.
$apiKey = $_SERVER['HTTP_X_API_KEY'] ?? '';
if (!hash_equals(getenv('CLL_API_KEY'), $apiKey)) {
    http_response_code(401);
    exit('Invalid API key');
}

$payload = json_decode($rawBody, true);
// ... handle $payload['lead'] ...

import crypto from 'node:crypto';
import express from 'express';

const app = express();

// Capture the RAW body — signature must be checked against the exact bytes.
app.post(
  '/webhooks/leads',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const raw = req.body; // Buffer
    const expected =
      'sha256=' +
      crypto
        .createHmac('sha256', process.env.CLL_WEBHOOK_SECRET)
        .update(raw)
        .digest('hex');

    const got = req.get('X-CLL-Signature') || '';
    const ok =
      expected.length === got.length &&
      crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(got));

    if (!ok) return res.status(401).send('Invalid signature');

    if (req.get('X-API-Key') !== process.env.CLL_API_KEY) {
      return res.status(401).send('Invalid API key');
    }

    const payload = JSON.parse(raw.toString('utf8'));
    // ... handle payload.lead ...
    res.sendStatus(200);
  },
);

import hmac, hashlib, os
from flask import Flask, request, abort

app = Flask(__name__)

@app.post("/webhooks/leads")
def leads():
    raw = request.get_data()  # RAW bytes — do not use request.json here
    secret = os.environ["CLL_WEBHOOK_SECRET"].encode()
    expected = "sha256=" + hmac.new(secret, raw, hashlib.sha256).hexdigest()

    got = request.headers.get("X-CLL-Signature", "")
    if not hmac.compare_digest(expected, got):
        abort(401, "Invalid signature")

    if not hmac.compare_digest(
        os.environ["CLL_API_KEY"], request.headers.get("X-API-Key", "")
    ):
        abort(401, "Invalid API key")

    payload = request.get_json()
    # ... handle payload["lead"] ...
    return "", 200