Send chatbot leads to your CRM
Configure a signed CRM webhook, understand the payload, verify signatures, and test delivery.
CRM lead delivery is available on Pro and Business. In Widget → CRM lead delivery, enter your public HTTPS webhook endpoint and a random signing secret of at least 16 characters. The secret is encrypted at rest and is never shown again.
Enable Show ‘Leave your details’ lead form, save the widget, then click Enable CRM delivery. Visitors must provide an email or phone number and actively tick the consent box before QaribuBot accepts the lead.
Use Send test lead to make a real request to your endpoint. Your endpoint must return any 2xx status within 10 seconds. Failed deliveries retry with exponential backoff for up to eight attempts.
Each request includes Content-Type: application/json, X-QaribuBot-Event: lead.created, X-QaribuBot-Event-Id, X-QaribuBot-Timestamp, and X-QaribuBot-Signature.
Example payload: {"event":"lead.created","eventId":"4d9b…","occurredAt":"2026-09-26T10:15:30.000Z","siteId":"site_123","lead":{"id":"lead_123","name":"Amina","email":"amina@example.com","phone":"+254700000000","message":"Please call me about the Pro plan","sourceUrl":"https://example.com/pricing","consent":true}}
Verify the signature by computing HMAC-SHA256(secret, timestamp + '.' + rawRequestBody), hex-encoding it, prefixing it with sha256=, and comparing it to X-QaribuBot-Signature with a timing-safe comparison. Reject timestamps older than five minutes and store X-QaribuBot-Event-Id so retries are idempotent.
Node.js example: const expected = 'sha256=' + crypto.createHmac('sha256', process.env.QARIBUBOT_SECRET).update(req.get('X-QaribuBot-Timestamp') + '.' + req.rawBody).digest('hex'); const valid = crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(req.get('X-QaribuBot-Signature') || ''));
Only return 2xx after the lead has been accepted or durably queued by your CRM. Do not log the signing secret or full personal details. Apply your own retention policy and privacy notice to data received by the endpoint.
To disable delivery, click Disable. QaribuBot keeps accepting only what the active configuration allows; Trial and Starter cannot call or configure the CRM endpoints.