Turn every signed Framer form submission into a verified CRM receipt.

import crypto from "node:crypto";

app.use(
  "/framer/form",
  express.raw({ type: "application/json" })
);

app.post("/framer/form", async (req, res) => {
  const signature = req.headers["framer-signature"];
  const submissionId = req.headers["framer-webhook-submission-id"];
  const secret = process.env.FRAMER_WEBHOOK_SECRET;
  if (
    typeof signature !== "string" ||
    typeof submissionId !== "string" ||
    !secret ||
    !/^sha256=[0-9a-f]{64}$/i.test(signature)
  ) {
    return res.sendStatus(401);
  }

  const expected = crypto
    .createHmac("sha256", secret)
    .update(req.body)
    .update(submissionId)
    .digest();
  const supplied = Buffer.from(signature.slice(7), "hex");
  const authentic =
    supplied.length === expected.length &&
    crypto.timingSafeEqual(supplied, expected);
  if (!authentic) return res.sendStatus(401);

  const form = JSON.parse(req.body.toString("utf-8"));
  const lead = {
    name: form.name,
    email: form.email,
    phone: form.phone
  };

  if (lead.name && lead.email) {
    await deliveryQueue.send({ submissionId, lead });
  }
  return res.sendStatus(204);
});

export async function deliverFramerLead({ submissionId, lead }) {
  const response = await fetch(
    "https://leadproof.jessesay.chatgpt.site/api/v1/leads",
    {
      method: "POST",
      headers: {
        Authorization: `Bearer ${process.env.LEADPROOF_API_KEY}`,
        "Content-Type": "application/json",
        "Idempotency-Key": submissionId
      },
      body: JSON.stringify({
        destination: process.env.CRM_WEBHOOK_URL,
        ...lead,
        source: "framer_form"
      })
    }
  );

  if (!response.ok) throw new Error("Lead delivery failed");
  const delivery = await response.json();
    await persistReceipt(submissionId, delivery.receipt?.id);
}