Send website requests to your CRM, Zapier or Make
Each request sent from your website can also arrive at an address of yours as a signed JSON POST — a webhook.
Set it up
The request is still saved in Keyio and emailed to you as always; the webhook is an extra copy for your own system.
- 1In your tool, create a webhook trigger (in Zapier, "Webhooks by Zapier › Catch Hook"; in Make, "Custom webhook") and copy its address.
- 2In Web › Measuring › "Send requests to your system", paste it and publish. The address must be https, on the standard port and of a public server.
- 3On publishing, Keyio creates the signing secret and shows it under the address.
- 4Press Send a test: a made-up request arrives with "test": true, and the editor tells you what your system answered.
What arrives
A POST with a JSON body: "event": "website.request", the request's id and date, the website (slug and domain) and the request itself — name, email, phone, message, home, arrival and departure dates, guests, quoted amount and the visitor's language.
Keyio tries once and waits up to 3 seconds for an answer (any 2xx counts as received). Redirects are not followed. If your system is down, the request is not lost: it is in Keyio and in your email.
Check that it comes from Keyio
Each delivery carries the header X-Keyio-Signature: t=<unix seconds>,v1=<signature>. The signature is the HMAC-SHA256, in hex, of the text "<t>.<raw body>" with your secret. Compute it with the body exactly as received, compare it with v1, and reject old timestamps (for example, more than five minutes) so a copied delivery cannot be replayed.
Zapier and Make accept the request without checking the signature; check it if your own server receives it.