Leads in Make, n8n and Zapier

Connect the webhook

1. Publish the tour and open the contacts for the permanent link. The Webhook section is in that dialog.
2. Paste the https URL from Make, n8n or Zapier. https only, port 443, on a public host.
3. Generate a whsec_… secret or paste the one the destination created. Save it: the full value is not shown again.
4. Save and click Send test. The test event has type lead.test.

The default event is lead.created (opening form, source: "start", and closing form, source: "contact"). lead.session_completed is optional and fires when the person finishes the tour, with progress.reachedStep.

Field overview: Integrations.

What the POST contains

Content-Type: application/json. For lead.created, webhook-id is the lead id and stays the same on every retry. The phone number is E.164. lead.consent has given, the text the person saw (text) and the time (at).

{
  "type": "lead.created",
  "id": "6f1c0e2a-4b7d-4e0a-9c3d-1a2b3c4d5e6f",
  "createdAt": "2026-10-25T14:00:00.000Z",
  "source": "start",
  "lead": {
    "name": "Ana Souza",
    "email": "[email protected]",
    "phone": "+5511999999999",
    "message": null,
    "lang": "pt",
    "consent": {
      "given": true,
      "text": "I agree to be contacted about this tour.",
      "at": "2026-10-25T14:00:00.000Z"
    }
  },
  "tour": {
    "slug": "checkout",
    "title": "Checkout tour",
    "url": "https://guiaflow.pro/p/checkout"
  },
  "context": {
    "referrerHost": "linkedin.com",
    "utm_source": "linkedin",
    "utm_medium": "social",
    "utm_campaign": "launch",
    "embed": false,
    "device": "desktop"
  }
}

Check the signature

Standard Webhooks. The three headers:

The signed content is webhook-id + . + webhook-timestamp + . + the raw POST body (do not rebuild the JSON). The key is the base64 after whsec_. The HMAC is SHA-256 and the digest is base64. Reject a clock skew of more than 5 minutes.

Node example, the same algorithm GuiaFlow uses to send: verify-signature.mjs.

import { verifyStandardWebhook } from "./verify-signature.mjs";

const raw = await readRawBody(req);
const ok = verifyStandardWebhook({
  secret: process.env.GUIAFLOW_WEBHOOK_SECRET,
  id: req.headers["webhook-id"],
  timestamp: req.headers["webhook-timestamp"],
  signature: req.headers["webhook-signature"],
  body: raw,
});

The n8n templates already include this step (Raw Body on the webhook and a Verificar assinatura code node). Replace whsec_COLE_O_SEGREDO. Make and Zapier answer 200 as soon as they accept the call, before later modules run, so they do not reject a bad signature in the HTTP response. Use n8n or the Node example when a forged POST must be refused.

Google Sheets

One row per contact, on a sheet named Leads. Create the header row in this order:

id, criado_em, origem, nome, email, telefone, mensagem, tour, url, utm_source, utm_medium, utm_campaign, referrer, consentimento.

Make

1. Create a scenario. Add Webhooks → Custom webhook, click Add, name it and copy the URL into GuiaFlow.
2. Save the webhook in the editor and click Send test. In Make, Run once so it learns the JSON.
3. Add Google Sheets → Add a row. Connect Google, pick the spreadsheet and the Leads sheet.
4. Map each column: nome from lead.name, email from lead.email, telefone from lead.phone (E.164), tour from tour.title, url from tour.url, id from the event id, utm_* and referrer from context, and consentimento from lead.consent.given.
5. Turn the scenario on.

HTTP blueprint, if you already have a Google OAuth token for the Sheets API: make-google-sheets.json. Import it into a new scenario (three-dot menu → Import blueprint). On the first module, create a new webhook. Replace SEU_ID_DA_PLANILHA and SEU_TOKEN_GOOGLE. The row is appended on the Leads sheet, in the header order above.

n8n

1. Import n8n-google-sheets.json (workflow menu → Import from file).
2. In Verificar assinatura, paste the whsec_…. In Acrescentar linha, connect Google and replace SEU_ID_DA_PLANILHA with the id in /spreadsheets/d/ in the spreadsheet URL. The sheet must be named Leads.
3. Copy the production webhook URL (not the test URL) into GuiaFlow. Send the test and activate the workflow.

In Zapier the trigger is Webhooks by Zapier → Catch Hook and the action is Google Sheets → Create Spreadsheet Row. See Zapier.

Pipefy

Creates a card directly in a phase. The pipe id is the number in the URL: https://app.pipefy.com/pipes/123456. Phase and field ids come from this query (a token from app.pipefy.com/tokens, or a service account, which Pipefy recommends for production):

{
  pipe(id: 123456) {
    name
    phases { id name }
    start_form_fields { id label required type }
  }
}

POST https://api.pipefy.com/graphql with Authorization: Bearer and the token. Mutation reference: createCard.

Make

1. Import make-pipefy.json. On the webhook, click Add and copy the URL into GuiaFlow.
2. In the HTTP module, replace SEU_TOKEN_PIPEFY. In the body, pipe and phase are "0": put the real ids. The sample field_id values are nome, email and telefone — use the ids from the query, and include every required start-form field.
3. Send the test from the editor. The response must include data.createCard.card.id. An errors array means the card was not created.
4. Turn the scenario on. The same result is available with Pipefy → Create a Card: pick the pipe and the phase from the list and map lead.name, lead.email and lead.phone.

n8n

1. Import n8n-pipefy.json.
2. Paste the secret into the signature node. In Criar card, replace the token, pipe, phase and the field_id values.
3. Paste the production URL into GuiaFlow, send the test and activate.

In Zapier: Webhooks by Zapier → Catch Hook, then Pipefy → Create Card.

Pipedrive

Creates the person with API v2 and a lead linked to that person (POST /api/v1/leads). The host is your company domain, the same one in the browser bar: https://SUA_EMPRESA.pipedrive.com. The token is under Personal preferences → API and is sent in the x-api-token header. Reference: persons (v2) and leads.

Make

1. Import make-pipedrive.json. Create the webhook on the first module and paste the URL into GuiaFlow.
2. In both HTTP modules, replace SUA_EMPRESA and SEU_TOKEN_PIPEDRIVE. The second module reads data.id from the person just created and stores the GuiaFlow lead id in origin_id.
3. If a contact has no email or no phone, remove the matching empty array from the person body. Send the test and check the person and the lead in Pipedrive.
4. The same flow exists as Pipedrive → Create a Person and Create a Lead, mapping name, email and phone.

n8n

1. Import n8n-pipedrive.json.
2. Paste the secret. In Criar pessoa and Criar lead, replace the subdomain and the token.
3. Production URL in GuiaFlow, then test and activate.

In Zapier: Webhooks by Zapier → Catch Hook, then Pipedrive → Create Person. A following step can create the lead with that person id.

Zapier

Zapier starts from the Webhooks by Zapier trigger, event Catch Hook. There is no connector named GuiaFlow.

1. Create a Zap. For the trigger, choose Webhooks by Zapier → Catch Hook and copy the URL into the tour webhook.
2. In the GuiaFlow editor, save and click Send test. In Zapier, test the trigger so it shows lead, tour and context.
3. The action depends on the destination: Google Sheets → Create Spreadsheet Row, Pipefy → Create Card or Pipedrive → Create Person. Map name, email, phone and the tour title.
4. Publish the Zap.

Catch Hook does not check the HMAC. To refuse a POST without a valid signature, use the n8n template or verify-signature.mjs.

Delivery and retries

• GuiaFlow waits at most 5 seconds and does not follow redirects. Any 2xx counts as delivered.
• When the call fails, the same message is sent again with the same webhook-id and a new signature. After the immediate attempt the gaps are 1 minute, 5 minutes, 30 minutes, 2 hours and 12 hours.
• About 20 failures in a row turn the webhook off. Saving again, or rotating the secret, clears the count.
• A destination that answers 200 and only then writes the card can duplicate the contact if the write takes longer than 5 seconds: GuiaFlow tries again. The lead id is the key for spotting the duplicate.

Questions: [email protected].