Webhooks
Send new leads to your own endpoint, and check that each delivery really came from ZenFlip.
Webhooks
A webhook sends each new lead to an endpoint you run, so you can pass it on to your own systems. Webhooks are available on Business and Enterprise plans.
Setting Up a Webhook
Go to Settings → Integrations.
Under Webhook Configuration, enter your endpoint URL and click Save.
Click Send Test Event to check that your endpoint receives it. Recent deliveries and their response codes are listed on the same page.
The endpoint must be a public https address. Addresses on private networks are refused.
Only organization admins can change the webhook.
Verifying Deliveries
Every delivery carries an X-ZenFlip-Signature header, so your endpoint can tell a real ZenFlip delivery from anyone else posting to the same URL:
` X-ZenFlip-Signature: t=1792651619,v1=5f2b… `
tis the time the delivery was signed, in Unix seconds.v1is an HMAC-SHA256, in hex, of the timestamp, a full stop and the raw request body (t + "." + body), keyed with your signing secret.
To find the secret, click Reveal signing secret under Webhook Configuration. Only organization admins can see it. Keep it on your server and never put it in browser code.
To check a delivery:
Recompute the HMAC from the raw body, before your framework parses it.
Compare it with
v1in constant time.Reject deliveries whose
tis more than five minutes old.
`js const crypto = require('crypto');
function isFromZenFlip(secret, rawBody, header) { const parts = Object.fromEntries(header.split(',').map((p) => p.split('='))); if (Math.abs(Date.now() / 1000 - Number(parts.t)) > 300) return false; const expected = crypto.createHmac('sha256', secret).update(${parts.t}.${rawBody}).digest('hex'); return expected.length === parts.v1?.length && crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1)); } `