Lead webhook

Last updated: 12 September 2026

On the paid plans, every lead CommentFor captures can also be sent to a URL you choose, as one signed JSON request. Zapier and Make read it directly (a "Catch Hook" trigger in Zapier, a "Custom webhook" in Make), and from there Shopify, Klaviyo, Google Sheets or anything else they connect to is one step away. Your own server can read it too.

Setting it up

In the app, open Settings → Lead webhook. Paste the URL your receiver gave you and choose a signing key: any string you like, which you keep on the receiving side to check the signature. Save, then press Send a test event; the page tells you what your receiver answered.

The URL must start with https:// and use a public host name that resolves to a public address; that is checked when you save and again before each event. Bare addresses, credentials in the URL, and local or internal names are refused. Redirects are not followed, so the URL should answer directly with a 2xx.

The request

One POST per captured lead, with these headers:

Content-Type: application/json
User-Agent: CommentFor-Webhook/1
X-CommentFor-Signature: {hex HMAC-SHA256 of the raw body under your signing key}

And this body:

{
  "event": "lead.captured",
  "lead": {
    "id": 4821,
    "email": "fan@example.com",
    "username": "fan_1",
    "captured_at": "2026-09-12T08:41:07.213456+00:00"
  },
  "account": {
    "id": 17,
    "username": "yourbrand",
    "channel": "instagram"
  },
  "automation": {
    "id": 92,
    "name": "Reel drop"
  }
}

lead carries what the paid plans' CSV export carries: the address the person sent, their handle on the channel, and when. account is the connected account the comment arrived on; channel is instagram or facebook. automation is the automation that captured the lead, or null if it has since been deleted. The test button sends the same shape with "event": "lead.test", a stand-in address and no account.

Checking the signature

Compute HMAC-SHA256 over the raw request body, exactly as received, with your signing key, and compare the hex digest to the header with a constant-time comparison. In Python:

import hashlib, hmac

def verify(body: bytes, header: str, key: str) -> bool:
    expected = hmac.new(key.encode(), body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, header)

Zapier and Make do not check signatures; the URL they give you is unguessable, which is their model. If that is enough for you, set any signing key and ignore the header.

Delivery

One attempt per lead, shortly after the address arrives, with a ten-second timeout. A refusal or a timeout is logged on our side and not retried: the lead is still in your dashboard and, on the paid plans, in your CSV export. Kit or Flodesk forwarding, also a paid-plan feature, is separate and unaffected if you have it. Changing the URL or the key applies to leads captured from then on.

Removing the webhook in Settings stops delivery at once and works on any plan, so a downgrade never leaves a destination you cannot clear.

Questions

support@commentfor.com, with the URL you configured and roughly when the lead came in.