Securing Your Webhook Endpoint
How Lead Distro AI authenticates to your webhook endpoint when delivering leads. Auth types, custom headers, and where to configure them.
Correction, September 2026. Earlier versions of this page described an X-LeadDistro-Signature HMAC header on outbound deliveries. That was documented in error. Lead Distro AI does not sign outbound webhooks, and no signing secret exists on your account. If you built a verifier against that header, it will reject every delivery. Use one of the authentication options below instead.
How This Works
When Lead Distro AI delivers a lead, it POSTs to the endpoint URL you configured on the destination. Your server is the API and Lead Distro AI is the client, so your server decides how to verify the request. You have two controls, and you can use both.
- A secret endpoint URL. Most integrations rely on this alone: an unguessable path that only you and Lead Distro AI know. Treat the URL itself as a credential and never publish it.
- A credential you issue. You choose a username, token, or key, configure it on the destination, and Lead Distro AI sends it as a header on every delivery. This is the stronger option because it survives a leaked URL.
Authentication Options
| Option | Header we send | Use when |
|---|---|---|
| None | No auth header | Your endpoint URL is your only control. |
| Basic Auth | Authorization: Basic | Your endpoint already speaks HTTP Basic. |
| Bearer Token | Authorization: Bearer | You issue long-lived tokens. Most CRM ingest APIs work this way. |
| API Key | X-API-Key: , or any header name you choose | You want the credential in a custom header. |
| OAuth 2.0 | Authorization: Bearer | Your API mints short-lived tokens from a client id and secret. |
OAuth 2.0 tokens are fetched at delivery time, milliseconds before the POST that spends them, so an endpoint whose tokens expire on inactivity stays reachable without any refresh job on your side.
A credential left blank sends no header at all rather than a malformed one. A half-filled Basic Auth config (username typed, password not yet) gives you a clean 401 you can read, instead of one that looks like a wrong password and sends you hunting in the wrong place.
Where to Configure It
- Open the campaign and find the destination in the routing table.
- Open its row menu and choose Edit.
- Scroll to Delivery Method and select Webhook (POST).
- Set Authorization to the option your endpoint expects, then fill in the credential.
- Save. The next delivery carries the header.
Custom Headers
Below the Authorization picker is a Custom Headers editor for anything else your endpoint needs, such as a tenant id or an account number. Authorization wins on a name collision, so a credential set in the picker is never silently overridden by a stale hand-written row.
Confirming a Delivery Reached You
Every delivery attempt is logged with the exact request headers, request body, response status, and response body. Open the lead, go to the Logs tab, and expand the delivery row. If your endpoint rejected the lead, the reason your server returned is shown verbatim.
Frequently Asked Questions
Does Lead Distro AI sign outbound webhooks with HMAC?
X-LeadDistro-Signature header and no per-destination signing secret. Earlier documentation described one in error. Authenticate deliveries with Basic Auth, a Bearer token, an API key header, or OAuth 2.0, all configured per destination.How do I stop someone else POSTing fake leads to my endpoint?
crypto.timingSafeEqual in Node, hmac.compare_digest in Python, hash_equals in PHP) rather than ===.What header does the API Key option send?
X-API-Key by default. You can set any header name you want in the same panel, so if your API expects something bespoke, enter that name and Lead Distro AI will use it.Can I rotate a credential without downtime?
Do you retry a failed delivery?
What happens to my other delivery methods if the webhook fails?
Related Articles
If you have any questions, send us an email at support@leaddistro.ai