Connect website lead intake

For: Company admins and integration owners
Owner: Integration operations
Outcome: Test, monitor, recover, rotate, and disconnect website lead intake safely.
Last verified: 2026-08-30
Next review: 2026-11-28
Status: supported

Capture website enquiries through the supported secret-protected intake path. This guide uses the current supported Sakhaa setup surface and keeps provider-owned approval and availability separate.

Prepare the connection

Provider approval and field availability can differ by source.

Create a dedicated source and owner for the website form.
Store the webhook secret on the website server. Do not expose it in browser code.
Send one synthetic submission and confirm consent, source, owner, and duplicate behaviour.

Connect and prove health

Open /app/settings/lead-sources in the correct workspace.
Save the oauth, webhook secret, or connector key only in the protected setup surface.
Use the source test action or a provider test record. Do not use customer data.
Confirm this healthy result: The test record appears once with the expected source, owner, and fields.

Use synthetic data and an approved test identity. Do not use customer traffic only to prove a connection.

Monitor and recover

Monitor: Review connector status, source logs, duplicate results, and routing outcome.
Recover: Correct credentials or mappings, retest with a new test identifier, and review failed logs.
Rotate: Rotate the source secret in the provider and Sakhaa during the same maintenance window.
Disconnect: Disable intake first, preserve logs, and confirm where new records will be routed.
Limits: Provider approval and field availability can differ by source.
Fallback: Keep the previous approved intake source active, or route new work to a reviewed manual queue until the connection is healthy.

Support boundary

Sakhaa supports the CRM configuration and product behavior. The provider controls account approval, billing, quotas, and external service availability.

Record the provider, workspace, approximate time, safe error code, expected result, and actual result.
Do not include passwords, access tokens, API secrets, message content, or unnecessary customer data.