Webhook

Also called: HTTP callback, Web callback.

Instead of your system asking "anything new?" every few minutes, the source app calls you. When an event happens, such as a search finishing or a new lead arriving, it sends an HTTP POST with a JSON body to your endpoint.

Because anyone can send a request to a public URL, good webhooks are signed. The sender computes an HMAC (RFC 2104) of the payload with a shared secret and puts it in a header; your endpoint recomputes it and rejects anything that doesn't match. Including a timestamp in the signature protects against replays. The Standard Webhooks specification describes a common way to do this.

Design your receiver to be idempotent, because senders retry on failures and you may get the same event twice. Respond quickly with a 2xx code and do the heavy work in a background job.

In a lead workflow, webhooks connect list building to everything after it: pushing new leads into a CRM, starting an enrichment step, or notifying a sales channel when a monitor finds new businesses.

Example

When a search completes, a webhook posts to an agency's endpoint. Its server verifies the signature, then adds the new leads to a client's HubSpot and posts a summary in Slack.

In Leadraft

Leadraft sends signed webhooks, and also connects through Zapier, Google Sheets and JSON feeds, and direct pushes to Instantly, Smartlead, lemlist and HubSpot.