Skip to main content
A source identifies the form, website, partner, CRM, or other intake path sending leads to Leadping. Each source has its own key so Leadping can authenticate and attribute incoming leads. Create separate sources when you need to identify or disable intake paths independently.
Every external lead must include its own TrustedForm certificate URL. Creating or enabling a source does not remove that requirement.

​
Create a source

  1. Open Sources in Leadping.
  2. Select Add source.
  3. Enter a name that identifies the real intake path.
  4. Select Create source.
  5. Copy the generated source API key into the posting system’s protected configuration before closing the dialog. The full key is shown only when issued.
Use a name that remains clear to another operator, such as Acme Solar — Website Quote Form or Northstar CRM Import. A new source is enabled immediately and shows Not yet used until it receives its first lead.

​
Decide where to separate sources

Use a separate source when the posting system has a different owner, credential, or failure path. For example, a website form and a partner’s CRM should not share a key: you need to be able to stop the partner’s intake without interrupting the form. For campaigns using the same integration and owner, attribution fields such as utmCampaign or sourceMetadata may be sufficient. Agree on those field names with the sender before traffic begins. Keep a short integration record outside Leadping with the source name, technical owner, form or system URL, field mapping, and credential-rotation contact. Store the key in a secret manager, not in that record.

​
Source status

​
Use the source key

Send the key as a Bearer token to either supported external intake endpoint:
Source keys work with:
  • POST /leads
  • POST /leads/intake
They do not provide access to organization data or other API operations. Protect the key as a secret:
  • store it in the posting backend or the provider’s protected credential settings, never in public form code;
  • send it only over HTTPS;
  • keep it out of payloads, URLs, and logs; and
  • rotate it if exposed.

​
Review a source

The source page provides: The source list also shows when the source last received a lead and when its configuration was last updated.

​
Test the intake path

  1. Submit a lead from the real form, partner, CRM, or posting system.
  2. Keep the returned lead ID and wait for lead processing to complete.
  3. Open the lead and verify its source, TrustedForm URL, contact fields, tags, and metadata.
  4. Confirm the lead finishes processing as Ready and the source shows received activity.
  5. Verify the resulting conversation and workflow behavior.
Use the source metrics and logs to investigate missing traffic or unexpected volume.

​
Disable, rotate, or delete

  • Disable stops new intake without removing the source.
  • Rotate key invalidates the current key immediately and creates a replacement.
  • Delete permanently removes the source and stops its key from working.
Update the posting system immediately after rotating a key. The previous key cannot be restored.

​
Rotate without losing submissions

For a planned rotation, pause the sender or hold new submissions in its queue. Rotate the key, update every worker that posts for that source, then submit one controlled lead. Resume the queue after authentication succeeds. There is no overlap period in which both keys work. If a key is exposed, rotate it immediately and reconcile failed submissions afterward. Check all places that used the old key, including scheduled jobs and partner connections.

​
Investigate missing or unexpected volume

Compare the sender’s submission count with created leads over the same date range and time zone. An HTTP failure and a lead that later becomes Invalid are different outcomes; keep separate counts for each. Inspect individual responses before assuming a missing lead is a delivery delay. If an unfamiliar system is posting to the source, disable intake while you identify the sender and replace the credential. Use source names and IDs in support requests; never include the full key.

Implement TrustedForm

Capture and submit a certificate for every external lead.

Send a lead

Choose a payload shape and handle processing results.