Advanced Integration
Webhooks
Chatmount POSTs to your endpoint when a lead is captured. Each request is signed with HMAC-SHA256 so you can verify it really came from us.
Events we fire
Today, one event:
lead.captured— fires when the agent successfully captures a lead (via the pre-chat form, conversational collection, or booking flow)
Registering a webhook
From the agent dashboard, go to Leads → Configure → Destinations. Add a destination of type Webhook with:
- URL — your endpoint (HTTPS required for production)
- Method — POST (default), PUT, or PATCH
- Signing secret — generated by Chatmount; copy and store it server-side
- Custom headers — optional key/value pairs (e.g. X-Tenant-Id)
You can wire multiple destinations per agent — Chatmount POSTs to all of them in parallel.
Payload shape
{
"event": "lead.captured",
"chatbotId": "agent_abc123",
"data": {
"id": "lead_xyz789",
"name": "Alex Chen",
"email": "alex@example.com",
"phone": "+15551234567",
"company": "Acme Inc.",
"customFields": { "plan": "pro" },
"score": 82,
"source": "widget",
"captureMethod": "form",
"pageUrl": "https://yoursite.com/pricing",
"bookingStatus": null,
"createdAt": "2026-05-03T14:35:00Z"
}
}Verifying the signature
Every request includes an X-Chatmount-Signatureheader containing an HMAC-SHA256 of the raw request body, signed with your destination’s secret. Verify on every request — anyone can POST to a public URL.
import crypto from "crypto";
const expected = crypto
.createHmac("sha256", process.env.CHATMOUNT_SECRET)
.update(rawBody) // the exact bytes you received, NOT JSON.stringify(body)
.digest("hex");
const provided = req.headers["x-chatmount-signature"];
if (
!provided ||
!crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(provided))
) {
return res.status(401).end();
}For frameworks that JSON-parse the body before your handler (Next.js API routes, default Express), disable the body parser on the webhook route and read the raw bytes — otherwise the signature won’t match.
Retries
We retry failed deliveries with exponential backoff: 1m, 5m, 30m, 2h, 6h, 12h, 24h. After 7 attempts the delivery is dropped and a notification is sent to the workspace admin email.
A delivery is considered successful on any 2xx response. Aim for 200 OK within a few seconds; if your processing is long-running, accept the webhook synchronously and queue the actual work.
Related