Salesforce Integration

Yes — with an inbound endpoint. Our platform POSTs each delivered lead to a webhook URL you set. Salesforce doesn't catch an arbitrary webhook on its own, so you route ours through Zapier or Make (both have Salesforce actions) or an Apex REST endpoint you expose. There's no AppExchange app and no managed package — and we'd rather tell you that now than have you discover it after buying.

What you actually get

One thing, and it's the same for every CRM: a signed webhook. The moment a lead is delivered to your account, our platform sends an HTTP POST to the URL you set in Settings, with a JSON body and an HMAC-SHA256 signature so you can verify it came from us. There is no native Salesforce app and no marketplace listing — there's a documented, retrying, signed webhook that Salesforce (directly or through a middleware step) can receive. A webhook that works with anything is more than most lead vendors offer.

The payload

Every delivery POSTs this body (fake values; the structure is exactly what we send):

{
  "event": "lead.delivered",
  "delivery_id": "e3b0c442-98fc-1c14-9afb-4c8996fb9242",
  "lead_id": "9f1a2b3c-4d5e-6f70-8a9b-0c1d2e3f4a5b",
  "vertical": "business_loans",
  "delivered_at": "2026-08-04T18:24:07.512Z",
  "lead": {
    "full_name": "Jane Borrower",
    "email": "jane@example.com",
    "phone": "+18135550148",
    "amount_requested": 60000,
    "...": "the full borrower field payload — fields vary by vertical"
  },
  "trustedform_cert_url": "https://cert.trustedform.com/2vv…",
  "consent_version": "v2.0"
}

lead is the full borrower record — the same fields you see in the portal and email — and its contents vary by vertical. The request carries three headers: X-BBL-Timestamp (unix seconds), X-BBL-Signature (lowercase hex HMAC-SHA256 of `${timestamp}.${rawBody}` keyed with your signing secret), and X-BBL-Delivery-Id (use it as an idempotency key). The full reference — signature verification code, the retry ladder, and manual replay — lives on the webhook & CRM docs page; this page is just the Salesforce on-ramp.

How to receive it in Salesforce

An inbound endpoint is required: Salesforce won't ingest our webhook directly. The no-code route is a Zapier/Make connector with a Salesforce "Create Record" action; the developer route is an Apex REST service that verifies the signature and inserts a Lead.

Pick your route. No-code: a Zapier/Make connector. Developer: an Apex @RestResource endpoint (optionally fronted by a Salesforce Site).
Create the receiving URL. In Zapier use Catch Hook; in Make a Custom webhook; for Apex, deploy the REST class and get its public URL. Copy it.
Set it in our Settings. Paste into Webhook URL, save, and Generate secret (shown once). Delivery won't fire without a secret.
Map to a Lead or Contact. Map lead.email, lead.full_name, lead.phone and vertical fields from the production payload above; use delivery_id as the external/idempotency key.
Verify the signature (developer route). In Apex, recompute the HMAC over `${timestamp}.${rawBody}` and reject mismatches. Middleware users can add a verification step or rely on a secret URL.
Activate. Enable the connector or endpoint; leads now become Salesforce records on delivery.

What this will not do

No AppExchange app and no managed package.
Salesforce can't receive our webhook without an Apex endpoint or middleware — an inbound endpoint is required.
No two-way sync — we don't read from Salesforce.
No automatic field mapping — you map fields once.

Common questions

Can I send leads into Salesforce?

Yes, via an inbound endpoint. Salesforce doesn't catch an arbitrary webhook natively, so you either point our webhook at a middleware connector (Zapier or Make, which have Salesforce 'Create Record' actions) or expose an Apex REST service that verifies the signature and inserts a Lead. Both work; the connector is faster, the Apex endpoint keeps it in-house.

What's the developer path?

Write an Apex REST class (@RestResource) that reads the raw body, recomputes the HMAC-SHA256 over `${X-BBL-Timestamp}.${rawBody}` with your signing secret, rejects a mismatch, and inserts a Lead or Contact. Point our Webhook URL at that endpoint's public URL (via a Site or connected middleware). See the webhook docs for the verification logic.

Is there an AppExchange app?

No. There's no AppExchange listing and no managed package — there's a signed, retrying webhook plus your choice of an Apex endpoint or a middleware connector. We say so up front so nobody buys expecting a one-click install.

Reference: the webhook & CRM docs. Pricing: lead pricing.