Skip to content
New storyWe built Skald to count visitors. It caught an AI-key thief.
SkaldEvery visit, truly told.

Lead attribution · no-code tools

Zapier, Make and n8n lead tracking: any tool that can post JSON

Zapier, Make and n8n lead tracking in Skald takes a plain POST from your automation, with the hook's secret sent as a key, and counts each lead once.

Zapier, Make and n8n lead tracking is sending leads into Skald from any app those tools connect to, with no code. Each posts JSON, the plain text format these tools pass data in, such as {"action": "contact"}, to Skald's json hook. The secret goes along as a Bearer key in the Authorization header, or the tool signs the message, and Skald keeps each lead once per reference and stage.

30-day free trial · no card · we set it up within one working day · free to self-host

one automation, three tools · sample
  1. Zapier
  2. Make
  3. n8n
1 · triggerNew form entrya form, a CRM contact, a sheet row
2 · actionWebhooks by ZapierPOST · Authorization: Bearer <your-secret>
3 · Skald…/traffic-hooks/example.com/json
{"external_ref": "zap-entry-58",
 "action": "contact"}

answer {"ok": true, "recorded": 1, "duplicates": 0}

Sample automation. The same POST from all three tools: one header, one JSON body, no code. Run it again and the answer says "duplicates": 1.

[01] key or signature

Zapier has no easy way to sign a webhook. Skald's json hook takes a plain key instead.

Webhooks by Zapier sends the headers you type, but has no step that works out a signature. So the json hook also takes the hook's secret as a plain key: Authorization: Bearer. It reads the key only when no signature is sent. Set the headers and see whether the lead gets in. Every lead lands in your lead attribution.

X-Skald-Signature
Authorization
posted to
set a header
POST …/traffic-hooks/example.com/json
Content-Type: application/json
Authorization: Bearer <your-secret>

{"external_ref": "entry-58", "action": "contact"}
  1. Size64 KiB at most
  2. Key readthe right key, compared in constant time
  3. Rate60 a minute for the hook

200 {"ok": true, "recorded": 1, "duplicates": 0}

No signature, so the key is read. It is the hook's own secret: the lead is kept.

Sample request; <your-secret> stands for the hook's secret. A signature is t=<unix seconds>,v1=<hex HMAC-SHA256 of "<t>.<body>"> and is refused when t is more than 5 minutes off. Failed keys and signatures are listed under Last deliveries, as a count once a minute.

[02] check the body

Will Skald take this JSON? Check a lead body before your Zap sends it.

Two fields are needed: external_ref, the lead's own id in your tool, and action, one short word. The rest is optional. Pick a sample or type your own body: each lead gets a mark, and you see Skald's answer word for word.

edit the body
the body your step sends · edit it63 bytes

Skald's answer · if it arrived now

200 {"ok": true, "recorded": 1, "duplicates": 0}

  1. line 1entry-58: kept as Demos, completed

Checked in your browser with Skald's own rules: the needed fields, the action and stage words, the time, the label, the test mark, the 100-lead limit, the 64 KiB limit, and a time more than a day ahead. Nothing is sent. "recorded" assumes none of these leads arrived before. A vid is dropped while visitor IDs are off for the site. A time with no offset is read here in a sample site's zone, New York.

[03] one or a hundred

Send up to 100 leads in one message, under 64 KiB

A body can be one lead, a list of leads, or {"records": [...]}. One message counts once against the hook's 60 a minute, however many leads it holds. Two limits apply: 100 leads, and 64 KiB for the whole body, checked first.

move the slider
body size
1.4 KiB of 64 KiB

200 {"ok": true, "recorded": 20, "duplicates": 0}

20 leads in one message, 1 of the hook's 60 a minute.

{"external_ref": "row-311", "action": "signup"}

[04] set up

The same lead POST in Zapier, Make and n8n

In Skald, open Settings > Integrations > Zapier, Make, n8n (json), press Make secret, and copy the address and the secret. Then add one step in your tool. Only its name differs.

pick a tool

Zapier, with a Webhooks by Zapier step

the step's fields · sample
Event:        POST
URL:          https://stats.example.com/traffic-hooks/example.com/json
Payload Type: json
Data:         external_ref = (the entry's id)
              action       = contact
Headers:      Authorization = Bearer <your-secret>

Put the trigger before it: a new form entry, a new CRM contact, a new row. Map the entry's own id to external_ref, so a re-run of the Zap is never counted twice.

[05] limits

Where Zapier, Make and n8n lead tracking stops

Skald keeps what your step sends, once per reference and stage. The step itself is yours to build.

What it does not do

  • The plain key has no time in it, so a captured message could be sent again. It would still be one lead. If a key leaks, press Rotate secret: the old one stops at once.
  • Only the lead and json hooks take the key. The Calendly, Cal.com, Stripe, HubSpot and Typeform hooks read only their tool's own signature.
  • Each road keeps its own record. A lead sent through Zapier and through your server's lead file counts twice; Settings > Integrations > Status names it. Send each lead one way only.
  • Past 60 messages a minute for the hook, the answer is 429, which means slow down. Your tool waits and sends again; Skald never resends for it.
  • A lead without a vid has no journey. A vid is dropped while visitor IDs are off for the site (off by default).
  • A name and an email are kept only when the site keeps leads' names and emails in full. Only owners and admins can look a person up.

questions

Zapier, Make and n8n lead tracking FAQ

Straight answers, including what Skald does not do.

How do I send leads from Zapier to Skald?

Add a Webhooks by Zapier step with the event POST. Use the address from Skald's Zapier, Make, n8n (json) box, payload type json, map external_ref to the entry's id and set action, such as contact. Add the header Authorization with the value Bearer and your secret.

Do I need to write signing code?

No. The json hook takes the secret as a plain key in an Authorization: Bearer header, when the message has no X-Skald-Signature header. A tool that can sign may sign instead; in Make, an X-Skald-Signature header can be built from the timestamp, the body and the secret.

Can I send many leads at once?

Yes. One message can carry one lead, a list of them, or {"records": [...]}, up to 100. Each hook takes at most 60 messages a minute by default; a tool that gets a 429 answer should wait and send again.

Which fields does Skald need?

Two: external_ref, the lead's own id in your tool, and action, a short word such as contact, demo, signup or trial. Optional fields add the stage, the time with its offset, the visitor ID, first and last touch, country, device, a label, a test mark, and a name and email.

What if the same lead also comes from my server?

Each road keeps its own record, so a lead sent through Zapier and through your own lead push counts twice. Settings > Integrations > Status names any lead that arrived from two tools. Send each lead one way only.

Is a plain key safe?

It travels with every message, so use the https address exactly as shown and keep the secret in the tool's secure storage. A wrong key is refused like a bad signature. If a key leaks, press Rotate secret: the old one stops at once. Signing is stronger: a stolen signed message is useless after 5 minutes.

$ tail -f access.log | skald

See what AI does with your site. Free for 30 days.

No card. We set up hosted Skald for you within one working day, or you self-host it free. Every line of your log, sorted and added up.

Start free trial Live demo