CRM: set up auto-onboarding and webhooks

Auto-onboarding is off by default. First decide which actions you want: create a project, create a kickoff meeting, and/or send a welcome email. Adjust the project name, meeting name, and, if needed, the subject and message. The {{companyName}} placeholder inserts the company name. Save the configuration and deliberately enable auto-onboarding; enabled email and calendar actions can reach the contact.

Move the lead into the existing default Active stage. A project is linked to the lead and gets default onboarding tasks, provided project creation is possible. A kickoff is suggested as a 30-minute meeting for the next business day. If the responsible person has Google Calendar connected, a calendar entry with the contact as an attendee can also be created. The welcome email needs a contact email and a working send configuration. Then check the activities, project, and meeting; individual sub-steps can fail independently.

In the Integrations tab, open the inbound webhook. Copy the shown endpoint URL and secret. If only a path is shown, add your app's public base address. Store the secret only in your form or automation service's server-side integration.

{
  "companyName": "Example Inc.",
  "contactEmail": "contact@example.com",
  "contactName": "Alex Example",
  "phone": "+1 000 000 0000",
  "website": "https://example.com",
  "notes": "Inquiry via the website form"
}

1. Send a POST request with Content-Type application/json to the shown endpoint.
2. Pass the secret in the X-Webhook-Secret header.
3. Send at least companyName and contactEmail as non-empty strings.
4. Check the response: HTTP 201 returns the leadId. Then open the lead in CRM.

The new entry gets the default Lead stage and the Website source. contactName, phone, website, and notes are optional. Repeated requests create further leads; there's no matching by email here. HTTP 400 indicates invalid input, 401 a wrong secret, 404 an unknown organization, and 503 a missing webhook configuration. After rotating the secret, update every connected sender; the old secret becomes invalid afterward.

Enter a publicly reachable HTTPS URL and a shared secret, and save. Then open a lead and trigger the webhook action there. It transmits the lead.action event, a timestamp, the organization ID, plus the lead's ID, company, contact email, source, and creation date. The recipient should verify the X-Webhook-Signature header: sha256= followed by the hexadecimal HMAC-SHA256 of the unmodified request body, using the shared secret.

The external recipient gets the lead data listed above. Use a service built for this and check the trigger's result. Sending has a time limit; redirects aren't followed automatically. Triggering it again manually can kick off work again at the destination. Agree on protection against duplicate processing there if needed.