Webhook or API
They are two directions of the same conversation. With an API, your system asks ours for data whenever it wants it, which means asking repeatedly and mostly being told there is nothing new. With a webhook, you give us an address once and we post to it the moment there is something to say. For an event that happens occasionally and unpredictably, such as someone filling in a form on your card, the second is both faster and cheaper.
How the Receiver Knows It Is Genuine
The address you give is reachable by anyone who learns it, so a receiver needs to tell a real delivery from a forged one. That is what signing is for: the sender and receiver share a secret, the sender computes a signature over the exact bytes it is sending, and the receiver recomputes it and compares. A mismatch means the message was altered or did not come from us. This is why a webhook secret should be read from an environment file and never pasted into a chat or a ticket.
What Reaches Your CRM
Most CRMs do not accept a raw webhook directly, and they do not need to. Zapier, Make and n8n all accept an incoming webhook and pass it on to HubSpot, Salesforce, Pipedrive, a spreadsheet or anything else they connect to. That is the route this product takes deliberately: one well-specified delivery that any of them can read, instead of a list of built-in connectors that is always missing the one you use.
What Happens When Delivery Fails
The contact is saved before any delivery is attempted, so a CRM being down cannot lose it. The failure is recorded against the contact, so it can be retried and so the settings screen can tell you the webhook is broken. It is deliberately never shown to the visitor who filled in the form: they cannot act on it and they did nothing wrong.
Frequently asked questions
Do I need to write code to use a webhook?
No. Zapier, Make and n8n all accept an incoming webhook and pass the contact on to your CRM without any code.
What is a webhook secret for?
It proves a delivery is genuine. The sender signs the exact bytes it sends, and the receiver recomputes the signature to check nothing was forged or altered.
What happens if my endpoint is down?
The contact is already saved on our side before delivery is tried, so nothing is lost, and the failure is recorded against it rather than shown to the visitor.
Keep reading
Related terms
See it for your work
Put this into practice with your own card
Put your details on one card page, share it by link or QR code, and change them whenever they change. The printed code keeps working. No credit card required to start.