Inbound webhooks

An inbound webhook is a URL that accepts data from anything that can send an HTTP POST: Elementor, Wix, Make, Zapier, a lead form, your own code. Each request can start automations and, if you turn it on, create a contact and a lead.

Create one

In the app, open Automations → Webhooks and click New Webhook.
Give it a name. Leave Secret Token empty and NexaCloser makes one for you.
Copy the Webhook URL. It looks like https://hook.nexacloser.com/<slug>.
In an automation, choose the Webhook trigger and pick this webhook.

Send data

curl -X POST https://hook.nexacloser.com/<slug> \
  -H "Content-Type: application/json" \
  -H "X-Webhook-Token: <the webhook's secret token>" \
  -d '{ "full_name": "Dana Levi", "email": "[email protected]", "phone": "+972501234567", "form_name": "Contact us" }'

Send the secret in the X-Webhook-Token header, never in the URL.
JSON, application/x-www-form-urlencoded and multipart/form-data bodies are read. Any other body is read as JSON if it is JSON, otherwise kept as one raw text field.
Bodies up to 1 MB.

Answer:

{ "success": true, "execution_id": "whx_8plFFIhUWR", "automations_triggered": 1 }

What happens

Every active automation with this webhook as its trigger starts, with your fields available as variables in its steps.
With CRM Integration turned on for the webhook (auto-create a lead each time), phone, email and full_name (or name), after the webhook’s field mapping, become a CRM contact and a lead in the pipeline you chose. The contact is matched by phone, then email, like everywhere else.
Each request is stored on the webhook in the app, so you can see exactly what arrived.
The same body sent twice within 2 minutes counts once. The repeat answers with the first execution_id and "deduped": true and starts nothing, so senders that retry do not create doubles.

Errors

Status	`error`
`400`	`Missing webhook slug`
`401`	`Unauthorized — x-webhook-token header required`, or `Unauthorized` (wrong token)
`404`	`Webhook not found`: no active webhook with this slug
`413`	`payload_too_large`
`429`	`rate_limited`

Limits

Per webhook and sender IP: 100 requests per 10 seconds (200,000 per day) for a webhook with a secret token. A webhook without a secret is limited to 40 per minute and 5,000 per day, and anyone with its URL can post to it, so give every webhook a token.

Webhooks or the Contacts API?

Use an inbound webhook when a tool can only send a fixed payload (a form plugin, an ad platform) and you want an automation to decide what happens. Use the Contacts API when you write the code: you get validation errors back, consent records and a contact id.