ToolbenchDocs
Get a key

Integration recipe

Trigger a Zap from new Toolbench leads

Point POST /webhooks at a Webhooks by Zapier Catch Hook URL for lead.created — Zapier cannot verify Toolbench HMAC natively, so put verification on a small HTTPS proxy or accept only low-risk follow-ups until you add one.

Webhooks by Zapier catch hook; HMAC limits and a safe pattern.

Use a Catch Hook

In Zapier, create a Zap triggered by Webhooks by Zapier → Catch Hook. Copy the hook URL and register it with POST /webhooks for lead.created (write-mode token).

POST /webhooks
curl -s -X POST "https://app.toolbench.com/api/v1/webhooks" \
  -H "Authorization: Bearer $TB_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{:,:[]}'

HMAC on Zapier

Zapier's Catch Hook cannot validate Toolbench-Signature with your whsec_… secret. Options:

  • Verify before Zapier: Send webhooks to your own HTTPS endpoint (Cloudflare Worker, small Node service, etc.), verify the signature, then forward a normalized JSON payload to the Catch Hook.
  • Accept the tradeoff: Use the Catch Hook only for low-risk automations (internal Slack, staging CRM) and rotate the hook URL if it leaks. Do not expose unverified hooks on the public internet for PII-heavy flows.

Signature rules are the same as Verify Toolbench webhook signatures.

Map lead fields

Toolbench sends { id, type, created_at, account_id, data }. For lead.created, map data.lead.id, status, and source into Zapier fields, then add Gmail, Sheets, or Jobber steps as needed.