Slack and outbound webhooks
A Slack message or a signed JSON post for every new lead, and how to verify the signature.
Two cards under Automation send leads out instead of bringing them in. Slack posts a message to a channel for every new lead, and Outbound Webhook posts each new lead as JSON to an address you control, signed so your endpoint can check it came from Local Wrangler. Both also receive the unusual-drop-in-leads alert, which is checked once a day.
Slack
Click Connect on the Slackcard and paste an Incoming Webhook URL. The window's own words: Create an Incoming Webhook in your Slack workspace: Apps > Incoming Webhooks. Each new lead sends a message to your chosen channel. The message reads New lead with the name and, when set, the value, then Email, Phone, Source (source, medium and campaign when known), Page and Service. There is no secret to copy: the confirmation says that new leads and alerts will now be sent to the URL you gave, and that you can change or disconnect it from the card at any time. The Slack card has no Rotate secret button. Once connected it shows a Sending to line with your URL, and its pill reads Awaiting first event.
Outbound Webhook
Click Connect on the Outbound Webhookcard and paste your Receiving URL. The window's own words: Local Wrangler will POST lead events to this URL with a JSON payload. The address must be reachable on the public internet; a private or local address is refused. The confirmation shows your Webhook Secret once. Once connected the card shows a Sending to line with your URL, and its pill reads Awaiting first event.
For each new lead the body is a JSON object with event: "lead.created" and a lead object carrying name, email, phone, source, medium, campaign, the page it came from, value and service interest, where known. The drop alert is a body with event: "lead_alert" and an alert object with a title, a message and a link. Every request carries the header X-LW-Signature: the text sha256= followed by the HMAC-SHA256 of the exact request body, keyed with your secret, in hex. Recompute it on your side and compare before trusting a delivery.
Rotate and disconnect
Rotate secret on the Outbound Webhook card issues a new secret, shown once; deliveries are signed with it from then on, so update your endpoint first or check both for a moment. We will stop sending new leads to Outbound Webhook until you reconnect. The same holds for Slack.