Skip to main content
All guides

Webhooks

For members of Organic Forward. Updated 2026-07-13 (module launch).

Webhooks push your leads out of Organic Forward the moment they happen — into your CRM, your automation tool, or anything else with a URL. No copying, no checking two inboxes: a buyer contacts you here, and seconds later the lead is in your system.

Where: log in → Settings → Integrations → the API & Webhooks tab.

Set one up (once, ~5 minutes)

  1. In your receiving tool, create an incoming-webhook URL. Every major tool has one: n8n ("Webhook" node), Zapier ("Catch Hook"), Make ("Custom webhook"), GoHighLevel (inbound webhook trigger).
  2. Back here: Add endpoint → paste the URL (it must be https://).
  3. Tick what you want sent:
    • New conversation (lead) — a buyer starts a thread with you: quote requests and offer responses. For most members this is the one that matters.
    • Quote request (legacy form) and Brand inquiry — the direct form paths.
  4. Create — and copy the signing secret immediately. It is shown only once. If you lose it, delete the endpoint and make a new one.
  5. Press Send test. Within a minute a test event arrives at your URL and shows up in the endpoint's Log.

You can register up to five endpoints, switch any of them off with the toggle, and delete them anytime.

What arrives

A JSON message with the lead: who contacted you (as they consented to share), about which product or brand, their message — plus the marketing trail: where that buyer came from (campaign tags, ad click ids). That last part is what lets your CRM credit the right campaign for the lead.

Trust, but verify

Every delivery carries an X-OF-Signature header, like:

X-OF-Signature: t=1752390000,v1=6f2a…

v1 is an HMAC-SHA256 of t + . + the raw body, keyed with your signing secret. If you verify it (recommended for anything that writes into your CRM), reject signatures older than five minutes. Zapier/n8n starter flows can skip this; the URL itself is unguessable.

If your endpoint has a bad day

We don't give up on one failure. A failed delivery retries after 1 minute, then 5, 30, 2 hours and 12 hours. The endpoint's Log shows every attempt with the HTTP status your server returned. If an endpoint fails 20 times in a row we switch it off and mark it — fix the receiver, then flip the toggle back on.

Common questions

Nothing arrived. Deliveries go out within a minute, not instantly. Check the Log: if attempts show errors, your receiver is answering with a non-2xx code. If the Log is empty, the event type may not be ticked on this endpoint.

I lost the secret. Delete the endpoint, create it again, copy the new secret.

Does this send my page traffic? No. Only moments when a buyer deliberately contacts you — visits and views never leave as anything but your own aggregate statistics.

Is my buyer's data safe in my tool? Once a lead lands in your CRM, looking after it is your responsibility as a business — the buyer agreed to be contacted by you, so treat the data like the rest of your customer records.

Other guides