Feature
Push leads in with API Keys
A lead that lands in a form on your own site should already be in your CRM by the time you look. Mint an integration key from your account page, send it as an x-api-key header, and your website, your store, or a Zapier / n8n step creates and updates contacts directly. No support ticket, no OAuth setup, no waiting on us.
How the keys work
- Create a key in one click and name it after whatever will use it
- Shown once and stored only as a hash: we cannot read your key back, and neither can anyone who reaches the database
- Bound to your organization, so a key can only ever touch your data
- Revoke instantly; the key stops authenticating on the next request
- A "last used" column tells you whether an integration is actually calling in
One request is the whole integration
curl -X POST https://crm.hitthosting.com/api/crm/contacts \
-H "x-api-key: YOUR_KEY" \
-H "content-type: application/json" \
-d '{"email":"jane@example.com","full_name":"Jane Doe","company":"Acme"}'Contacts upsert on email, so re-sending the same person updates them instead of creating a duplicate. Key auth covers the contact endpoints (listing, creating or upserting, and duplicate detection); everything else still requires a signed-in session. Keep the key server-side: treat it like a password, never ship it in browser JavaScript.
The other direction: inbound webhooks
An API key works when you control the sender. Most tools you want to connect — a form builder, a scheduling tool, a payment processor — do the opposite: they send their payload to a URL you paste into their dashboard, signed with a shared secret, with no way to reshape the body. An inbound webhook endpoint accepts exactly that, and you map their fields onto your contact fields. Pro and Business.
- The sender posts its own body shape to a URL you paste into their dashboard — no reshaping on their side
- Map each contact field to a path in their payload; anything you do not map is kept on the contact rather than dropped
- Every request is verified with an HMAC-SHA256 signature and a timestamp window
- A delivery log records every attempt — created, updated, or rejected with the reason — so a broken integration is debuggable instead of silent
- Replay any logged delivery in one click after fixing a mapping
- Contacts only: it never sends email, starts a campaign, or enrols anyone in a sequence, and firing automations on inbound contacts is off unless you turn it on per endpoint