How to send leads straight into your CRM: webhooks, Zapier and native tools

If you pay for real-time leads, the minutes between a consumer pressing submit and your phone ringing are the most valuable part of the purchase. The way to protect them is to send leads to your CRM automatically, the instant they are delivered, so your team works them from the tool they already live in. This guide explains how webhooks work, how to verify them, three common setup patterns, how to map fields, and how to catch failures before they cost you a contact.

Why instant delivery matters

The research on response time is consistent. The Lead Response Management study (Oldroyd, MIT/InsideSales, 2007) found that the odds of contacting a lead dropped sharply after the first five minutes. Harvard Business Review’s “The Short Life of Online Sales Leads” (2011) found that firms that tried to contact leads within an hour were nearly seven times as likely to qualify them as firms that waited longer.

Every manual step erodes that window: an alert email sits unread, someone copies the name and phone into the CRM, the CRM assigns it, and only then does an action plan start. Automated delivery collapses those steps into one. The lead lands in your CRM, gets assigned and triggers your first text and call task within seconds. We go deeper on the first five minutes in our speed-to-lead guide.

Webhooks in plain English

A webhook is a message one system sends to another when something happens. With a lead vendor, the “something” is a lead being delivered to you. The vendor makes an HTTP POST request to a URL you provide, and the body of the request contains the lead.

• The URL is the address that receives leads: your CRM’s inbound lead URL, a Zapier Catch Hook, or an endpoint on your own server.
• The format is how the lead is written. Maple can send JSON, form-encoded or XML, the formats Zapier, GoHighLevel, Salesforce, HubSpot, Follow Up Boss and Pipedrive accept.
• Headers carry metadata. Maple sends X-Maple-Event (for example, lead.delivered) and X-Maple-Signature, and lets you add custom headers per campaign, which is where a CRM API key usually goes.
• The response tells the vendor whether it worked. A 2xx status code means success; anything else is treated as a failure and retried.

Here is an excerpt of a Maple lead.delivered payload:

{
  "event": "lead.delivered",
  "lead_number": 48213,
  "vertical": "mortgage",
  "lead_type": "FHA",
  "tier": "HOT_1",
  "price": 110,
  "first_name": "Jordan",
  "phone": "+12145550142",
  "state": "TX",
  "zip": "75201",
  "source": "facebook",
  "lead_age_minutes": 0.4,
  "attributes": { "loanAmount": 318000, "creditScore": "Good (680-739)", "propertyType": "Single Family" },
  "consent": { "trustedFormCertUrl": "https://cert.trustedform.com/…" }
}

Verifying HMAC signatures

If you receive leads on your own server, verify every request. A webhook URL is just an address; if it leaks, anyone can post to it. A signature proves the request came from the vendor and that the body was not changed in transit.

Maple signs each request with HMAC-SHA256 using a secret shared only with you. The X-Maple-Signature header looks like t=1760540000,v1=5f2c…: a Unix timestamp and a hex signature of the string timestamp.rawBody. Recompute it, compare in constant time, and reject anything older than five minutes so a captured request cannot be replayed later.

import { createHmac, timingSafeEqual } from "node:crypto";

// Use the raw request body, exactly as received (not re-serialized JSON).
export function verifyMapleSignature(rawBody, header, secret) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  const timestamp = Number(parts.t);

  // Reject requests older than 5 minutes.
  if (!timestamp || Math.abs(Date.now() / 1000 - timestamp) > 300) return false;

  const expected = createHmac("sha256", secret)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex");
  const a = Buffer.from(expected, "hex");
  const b = Buffer.from(parts.v1 ?? "", "hex");
  return a.length === b.length && timingSafeEqual(a, b);
}

Hosted tools such as a CRM’s inbound webhook or a Zapier Catch Hook generally do not verify custom signatures. There, protect the URL like a password, use a custom header with a token your receiving step checks where the tool supports it, and rotate the URL if it is exposed.

How to send leads to your CRM: three setup patterns

Exact menus change often, so treat these as patterns and follow your CRM’s current documentation for the clicks.

Follow Up Boss

Follow Up Boss is built around inbound lead sources. The usual approach is to generate an API key in Follow Up Boss, then connect through Zapier’s Follow Up Boss integration, or have a developer post leads to its inbound lead API with the key passed in a custom header. Set the lead source to something like “Maple Leads” so reporting and action plans can key off it, and map lead type to a tag so purchase and refinance leads, or buyer and seller leads, get different automations.

GoHighLevel

GoHighLevel workflows can start from an inbound webhook trigger. Create a workflow, add the inbound webhook trigger, copy the URL it gives you into your Maple campaign, and send a test lead so GoHighLevel can read the sample fields. Then add a create-or-update contact step, map the fields, apply tags, and chain your speed-to-lead steps: instant SMS, a call task or round-robin assignment, and a pipeline opportunity.

HubSpot, Salesforce and others via Zapier

When a CRM does not offer a simple inbound webhook, use Zapier (or a similar tool) as the bridge:

1. Create a new Zap with “Webhooks by Zapier” as the trigger and choose Catch Hook.
2. Copy the Catch Hook URL into your Maple campaign’s webhook settings, with JSON as the format.
3. Send a test lead from Maple so Zapier captures a real sample.
4. Add your CRM’s create-or-update contact (or lead) action and map each field from the sample.
5. Optionally add steps to notify the assigned agent, create a task, or post to a team channel.
6. Turn the Zap on and send one more test lead end to end.

Use create-or-update rather than create, matched on phone or email, so a returning consumer does not become a duplicate record.

Field mapping

Map fields once, carefully, and most downstream problems disappear. The table uses keys from the payload excerpt above; send a test lead to see every field in the full payload, including contact fields such as email.

Storing tier and price lets you measure cost per closed deal rather than cost per lead. Our guide to cost per funded loan shows how to use them.

Testing before you go live

Never let a paid lead be the first request your integration sees. In Maple, use “Send test lead” on the campaign to post a sample to your endpoint. Then check:

• The contact appears in the CRM with every mapped field filled in, not blank or shifted.
• Tags, lead source and owner assignment are correct.
• Your first automated text and call task fire within seconds.
• Duplicates are handled: send the same test twice and confirm you get one record.
• If you verify signatures, a request with a tampered body is rejected.

Repeat the test whenever you change the Zap, workflow, CRM fields or campaign settings.

If several people share one campaign, test assignment too. Send a few test leads in a row and confirm round-robin or ownership rules distribute them the way you expect, and that each assigned person gets the notification. A lead that lands in the CRM unassigned is almost as slow as one that never arrived. If you run more than one campaign, for example purchase and refinance, or buyer and seller, give each its own tag or lead source so a single test does not hide a mapping problem in another.

Monitoring failures and mobile alerts

Integrations break quietly: an API key expires, someone renames a custom field, a Zap gets paused. Build in three safety nets.

1. Retries and logs. Maple retries failed deliveries automatically with exponential backoff and logs every attempt with status code, latency and response in your portal. Check the log weekly, and immediately if leads seem quiet.
2. A second channel. Keep instant email alerts on alongside the webhook, and keep the buyer portal open during calling hours, so the team sees a lead even if the CRM step fails.
3. Mobile alerts. Turn on push notifications in your CRM’s mobile app for new leads assigned to you, or add a Zapier step that texts the assigned agent. The goal is that a new lead reaches a phone in someone’s hand, not just a database.

Finally, align delivery with your team. A campaign’s delivery schedule means you only receive leads when someone can call, which protects speed to lead better than any integration.