Skip to main content
Naturalead uses inbound webhooks to receive leads from external systems and messages from messaging channels. Each webhook type has its own authentication mechanism and setup process.

Lead Webhooks

Token-based authentication. Push leads from any CRM or form tool into Naturalead.

WhatsApp (Meta)

HMAC-SHA256 signature verification via the Meta Cloud API.

Telegram

Registered as a Telegram bot webhook URL via BotFather.

Email (Resend)

Inbound email events from Resend with conversation threading.

​
Lead inbound webhook

The lead webhook lets you push leads into Naturalead from any external system (CRM, landing page, form builder, etc.) without API key authentication. Each account has a unique webhook token.

​
WhatsApp webhook (Meta Cloud API)

The WhatsApp integration uses the Meta Cloud API. You need to configure your WABA (WhatsApp Business Account) in the Meta Developer Portal and point the webhook to Naturalead.
The WhatsApp webhook always returns HTTP 200, even on errors. This is required by Meta — non-200 responses cause Meta to retry with exponential backoff and eventually disable the webhook.

​
Telegram webhook

The Telegram integration uses a bot token from BotFather. Naturalead registers itself as the bot’s webhook endpoint.

​
Email webhook (Resend)

The email integration uses Resend for both sending and receiving emails. Inbound emails are received via Resend webhook events.

​
Webhook token management

Each Naturalead account has a unique webhookToken generated at account creation. This token is used exclusively for the lead inbound webhook and is separate from API keys.
  • The webhook token is visible via GET /api/accounts/current (requires account:view permission)
  • Webhook tokens do not expire — if compromised, contact support to regenerate
  • All leads created via webhook are logged to the audit trail with source: "webhook"

​
Troubleshooting