[{"data":1,"prerenderedAt":245},["ShallowReactive",2],{"navigation":3,"\u002Fgetting-started":53,"\u002Fgetting-started-surround":242},[4,13,28,46],{"title":5,"path":6,"stem":7,"children":8,"icon":12},"Getting Started","\u002Fgetting-started","1.getting-started\u002F1.index",[9],{"title":10,"path":6,"stem":7,"icon":11},"Concepts","i-lucide-house",false,{"title":14,"path":15,"stem":16,"children":17,"page":12},"Guides","\u002Fguides","2.guides",[18,23],{"title":19,"path":20,"stem":21,"icon":22},"Server webhooks","\u002Fguides\u002Fserver-webhooks","2.guides\u002F1.server-webhooks","i-lucide-server",{"title":24,"path":25,"stem":26,"icon":27},"Signed webhooks","\u002Fguides\u002Fsigned-webhooks","2.guides\u002F2.signed-webhooks","i-lucide-shield-check",{"title":29,"path":30,"stem":31,"children":32,"page":12},"Reference","\u002Freference","3.reference",[33,37,41],{"title":34,"path":35,"stem":36,"icon":22},"POST \u002Fapi\u002Fv1\u002Fingest","\u002Freference\u002Fingest","3.reference\u002F1.ingest",{"title":38,"path":39,"stem":40,"icon":27},"POST \u002Fapi\u002Fv1\u002Fingest\u002F:slug","\u002Freference\u002Fingest-slug","3.reference\u002F2.ingest-slug",{"title":42,"path":43,"stem":44,"icon":45},"Headers, errors & limits","\u002Freference\u002Fheaders-errors-limits","3.reference\u002F3.headers-errors-limits","i-lucide-list-checks",{"title":47,"path":48,"stem":49,"children":50,"icon":52},"Changelog","\u002Fchangelog","4.changelog\u002F1.index",[51],{"title":47,"path":48,"stem":49,"icon":52},"i-lucide-history",{"id":54,"title":10,"body":55,"description":235,"extension":236,"links":237,"meta":238,"navigation":239,"path":6,"seo":240,"sitemap":237,"stem":7,"__hash__":241},"docs\u002F1.getting-started\u002F1.index.md",{"type":56,"value":57,"toc":224},"minimark",[58,62,107,112,119,194,199,207,211,217,221],[59,60,61],"p",{},"Four objects show up in every integration:",[63,64,65,73,95,101],"ul",{},[66,67,68,72],"li",{},[69,70,71],"strong",{},"Workspace"," — the container everything else lives in. Your forms, leads, and credentials all belong to exactly one workspace.",[66,74,75,78,79,83,84,83,87,90,91,94],{},[69,76,77],{},"Form"," — a named, workspace-scoped definition of the fields you're submitting (",[80,81,82],"code",{},"name",", ",[80,85,86],{},"email",[80,88,89],{},"company",", …). Every form has a unique ",[69,92,93],{},"slug",", and optionally a webhook secret for signed submissions.",[66,96,97,100],{},[69,98,99],{},"Lead"," — a single submission. Every lead is attributed to the form it came in through, scored automatically, and (for clean submissions) enriched asynchronously.",[66,102,103,106],{},[69,104,105],{},"Token \u002F secret"," — the credential a given surface authenticates with. Which kind you need depends on which surface you're integrating against — see below.",[108,109,111],"h2",{"id":110},"three-surfaces-three-threat-models","Three surfaces, three threat models",[59,113,114,115],{},"Black Glass Leads exposes three ways to get a lead in, and they exist because they answer three different questions: ",[116,117,118],"em",{},"who is sending this, and how much do we trust the channel it arrives on?",[120,121,122,140],"table",{},[123,124,125],"thead",{},[126,127,128,131,134,137],"tr",{},[129,130],"th",{},[129,132,133],{},"Surface",[129,135,136],{},"Credential",[129,138,139],{},"Runs where",[141,142,143,162,178],"tbody",{},[126,144,145,151,154,159],{},[146,147,148],"td",{},[69,149,150],{},"1a",[146,152,153],{},"Server Bearer token",[146,155,156],{},[80,157,158],{},"Authorization: Bearer ingt_srv_…",[146,160,161],{},"Your backend, Zapier, Make — anywhere you can set a custom header and keep a secret server-side",[126,163,164,169,172,175],{},[146,165,166],{},[69,167,168],{},"1b",[146,170,171],{},"HMAC-signed slug webhook",[146,173,174],{},"Per-form webhook secret, signed per-request",[146,176,177],{},"A webhook provider posting to a public URL it doesn't control the trust of",[126,179,180,185,188,191],{},[146,181,182],{},[69,183,184],{},"2",[146,186,187],{},"Browser SDK",[146,189,190],{},"Origin-bound, short-lived submission token",[146,192,193],{},"The browser — the one place a long-lived secret can never be safe",[195,196,198],"h3",{"id":197},"surface-1a-server-bearer-tokens","Surface 1a — server Bearer tokens",[59,200,201,202,206],{},"The credential is a long-lived token that never leaves your server. The threat model is simple: as long as the token stays server-side, only you can submit leads with it. This is the surface to reach for first — it's the least ceremony for the most common case (your own backend, or a webhook-relay tool that supports custom headers). See the ",[203,204,205],"a",{"href":20},"server webhooks guide",".",[195,208,210],{"id":209},"surface-1b-hmac-signed-slug-webhooks","Surface 1b — HMAC-signed slug webhooks",[59,212,213,214,206],{},"Some webhook providers post to a public URL that anyone who finds it could hit — there's no way to keep the URL secret, so the credential can't be \"don't tell anyone the endpoint.\" Instead, every request is signed: a per-form secret produces an HMAC-SHA256 signature over a timestamp and the request body, and the timestamp bounds how long a captured request stays replayable. See the ",[203,215,216],{"href":25},"signed webhooks guide",[195,218,220],{"id":219},"surface-2-browser-sdk","Surface 2 — browser SDK",[59,222,223],{},"The browser is the one place you categorically cannot keep a secret — anything shipped to the client is visible to whoever opens dev tools. This surface trades a long-lived credential for a short-lived, origin-bound submission token minted just before use, so a leaked token is worthless outside the page that requested it and expires fast even if it isn't. The browser SDK guide is coming in a later phase of this site — for now, server webhooks or signed webhooks cover every integration we support.",{"title":225,"searchDepth":226,"depth":227,"links":228},"",1,2,[229],{"id":110,"depth":227,"text":111,"children":230},[231,233,234],{"id":197,"depth":232,"text":198},3,{"id":209,"depth":232,"text":210},{"id":219,"depth":232,"text":220},"Workspaces, forms, leads, and tokens — and which of the three ingestion surfaces to use.","md",null,{},{"icon":11},{"title":10,"description":235},"nzCBn-IjrjPgJk4V_nQY8vPJ-qTmPmjaEO-v1NjJ2_s",[237,243],{"title":19,"path":20,"stem":21,"description":244,"icon":22,"children":-1},"Bearer-token authentication for server-to-server lead submission — Surface 1a.",1786814658153]