Site2CRM API

curl -X POST https://api.site2crm.io/api/public/leads \
  -H "Content-Type: application/json" \
  -H "X-Org-Key: your_api_key_here" \
  -d '{"email": "lead@example.com", "name": "John Doe"}'

curl https://api.site2crm.io/api/webhooks \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..."

{
  "error": "Too many requests",
  "message": "Rate limit exceeded. Please try again in 45 seconds.",
  "retry_after": 45
}

{
  "event": "lead.created",
  "timestamp": "2026-02-25T14:30:00.000000",
  "data": {
    "lead_id": 12345,
    "email": "jane@acme.com",
    "name": "Jane Smith",
    "first_name": "Jane",
    "last_name": "Smith",
    "phone": "+15551234567",
    "company": "Acme Corp",
    "source": "form",
    "notes": null,
    "utm_source": "google",
    "utm_medium": "cpc",
    "utm_campaign": "spring_sale",
    "created_at": "2026-02-25T14:30:00.000000"
  }
}

import hmac, hashlib, json

def verify_signature(payload_bytes: bytes, secret: str, signature: str) -> bool:
    payload = json.loads(payload_bytes)
    canonical = json.dumps(payload, separators=(",", ":"), sort_keys=True)
    expected = "sha256=" + hmac.new(
        secret.encode("utf-8"),
        canonical.encode("utf-8"),
        hashlib.sha256,
    ).hexdigest()
    return hmac.compare_digest(expected, signature)

const crypto = require("crypto");

function verifySignature(payloadString, secret, signature) {
  const payload = JSON.parse(payloadString);
  const canonical = JSON.stringify(payload, Object.keys(payload).sort());
  // Note: use compact JSON with sorted keys matching Python's separators=(",",":")
  const expected = "sha256=" + crypto
    .createHmac("sha256", secret)
    .update(JSON.stringify(JSON.parse(payloadString), null, 0))
    .digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signature),
  );
}

// Simpler approach: canonicalize the same way as the server
function verifySignatureCanonical(payloadString, secret, signature) {
  const obj = JSON.parse(payloadString);
  const canonical = JSON.stringify(obj, Object.keys(obj).sort());
  // Remove spaces after separators to match Python's separators=(",",":")
  const compact = canonical.replace(/: /g, ":").replace(/, /g, ",");
  const expected = "sha256=" + crypto
    .createHmac("sha256", secret)
    .update(compact)
    .digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signature),
  );
}

{
  "detail": {
    "error": "validation_error",
    "message": "Email is required",
    "field": "email"
  }
}

curl -X POST https://api.site2crm.io/api/public/leads \
  -H "Content-Type: application/json" \
  -H "X-Org-Key: your_api_key_here" \
  -d '{
    "email": "jane@acme.com",
    "first_name": "Jane",
    "last_name": "Smith",
    "company": "Acme Corp",
    "phone": "(555) 123-4567",
    "source": "API",
    "utm_source": "google",
    "utm_campaign": "spring_sale"
  }'

const response = await fetch('https://api.site2crm.io/api/public/leads', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'X-Org-Key': 'your_api_key_here',
  },
  body: JSON.stringify({
    email: 'jane@acme.com',
    first_name: 'Jane',
    last_name: 'Smith',
    company: 'Acme Corp',
    source: 'Website Form',
  }),
});

const data = await response.json();
console.log(data);

import requests

response = requests.post(
    'https://api.site2crm.io/api/public/leads',
    headers={
        'Content-Type': 'application/json',
        'X-Org-Key': 'your_api_key_here',
    },
    json={
        'email': 'jane@acme.com',
        'first_name': 'Jane',
        'last_name': 'Smith',
        'company': 'Acme Corp',
        'source': 'Python Script',
    }
)

print(response.json())

<?php
$ch = curl_init('https://api.site2crm.io/api/public/leads');

curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST => true,
    CURLOPT_HTTPHEADER => [
        'Content-Type: application/json',
        'X-Org-Key: your_api_key_here',
    ],
    CURLOPT_POSTFIELDS => json_encode([
        'email' => 'jane@acme.com',
        'first_name' => 'Jane',
        'last_name' => 'Smith',
        'company' => 'Acme Corp',
        'source' => 'PHP Form',
    ]),
]);

$response = curl_exec($ch);
curl_close($ch);

print_r(json_decode($response, true));

curl -X POST https://api.site2crm.io/api/webhooks \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer your_jwt_token" \
  -d '{
    "url": "https://example.com/hooks/site2crm",
    "event": "lead.created",
    "description": "Slack new lead notification"
  }'

# Save the "secret" from the response for signature verification!

const crypto = require("crypto");
const express = require("express");
const app = express();

app.post("/hooks/site2crm", express.json(), (req, res) => {
  const signature = req.headers["x-site2crm-signature"];
  const secret = process.env.WEBHOOK_SECRET;

  // Canonicalize: compact JSON with sorted keys
  const canonical = JSON.stringify(
    JSON.parse(JSON.stringify(req.body)),
    Object.keys(req.body).sort(),
  ).replace(/: /g, ":").replace(/, /g, ",");

  const expected = "sha256=" + crypto
    .createHmac("sha256", secret)
    .update(canonical)
    .digest("hex");

  if (!crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature))) {
    return res.status(401).send("Invalid signature");
  }

  console.log("Event:", req.headers["x-site2crm-event"]);
  console.log("Data:", req.body.data);
  res.sendStatus(200);
});

import hmac, hashlib, json, os
from flask import Flask, request, abort

app = Flask(__name__)

@app.route("/hooks/site2crm", methods=["POST"])
def handle_webhook():
    signature = request.headers.get("X-Site2CRM-Signature", "")
    secret = os.environ["WEBHOOK_SECRET"]

    payload = request.get_json(force=True)
    canonical = json.dumps(payload, separators=(",", ":"), sort_keys=True)
    expected = "sha256=" + hmac.new(
        secret.encode(), canonical.encode(), hashlib.sha256
    ).hexdigest()

    if not hmac.compare_digest(expected, signature):
        abort(401, "Invalid signature")

    event = request.headers.get("X-Site2CRM-Event")
    print(f"Event: {event}, Data: {payload['data']}")
    return "", 200