Help · Leads

Send leads and members to your own tools (Connect)

Checked against the admin on October 21, 2026.

If you already use an email or automation tool, Settings › Connect sends it what happens in your studio as it happens: a new lead, a first booking, a purchase, a member who stopped coming. Frontmat feeds the tool; the tool does the rest. Owners and admins only.

Settings › Connect: the endpoint, the signing secret, the events, and the deliveries — Settings › Connect.

Set it up

In your tool, make an inbound webhook and copy its address (it starts with https://).
In Frontmat, open Settings › Connect, paste it into Endpoint URL, and click Save.
Copy the signing secret that appears. It is shown this once; after that the page shows only its ends. Lost it? Rotate the secret, and the old one stops working at once.
Under Events, tick what your tool should hear about and click Save events.
Click Send a test. Your tool gets a ping carrying a made-up lead, so it can learn the fields; filter on type to ignore it later.

The events

lead.created: a lead appears, from any source.
lead.followed_up: one of the three follow-up emails went.
member.joined: a lead became a member.
booking.first: someone took their first class.
purchase.completed: a pack, membership or drop-in was bought.
member.at_risk: a member's attendance halved.
member.lapsed: 28 days without a visit.

What each delivery carries

A POST with a JSON body: ids, the email, the name when known, the stage and the time. Never card data, never a price, never a credit balance.

{
  "id": "6f1c…",
  "type": "lead.created",
  "created": "2027-03-01T17:41:00.000Z",
  "studio": { "id": "…", "slug": "willow-oak" },
  "data": {
    "email": "june.park@example.com",
    "name": "June Park",
    "stage": "new",
    "source": "website"
  }
}

Member events carry memberId; purchase.completed carries productType (pack, membership or drop-in); lead.followed_up carries step.

Checking the signature

Every delivery has a Frontmat-Signature header, t=<unix seconds>,v1=<hex>, where v1 is HMAC-SHA256 of <t>.<raw body> with your secret. Also sent: Frontmat-Event and Frontmat-Delivery. In Node:

const [t, v1] = header.split(',').map((p) => p.split('=')[1])
const expected = crypto.createHmac('sha256', secret).update(`${t}.${rawBody}`).digest('hex')
const ok = crypto.timingSafeEqual(Buffer.from(v1), Buffer.from(expected))

Reject a timestamp more than five minutes old. A tool that cannot check a signature (Make without code, for one) can skip it: the address itself is private to you.

Deliveries and retries

Deliveries lists the last twenty: when, the event, the status and the attempts. Your tool has ten seconds to answer with a 2xx. If it does not, Frontmat tries again after a minute and after five minutes; after the third try the delivery says failed and waits for you to send again. Nothing is lost while your tool is down. Disconnect stops all of it and throws the secret away.

Tools

MailerLite: a free list and automations. Step by step: Send your leads to MailerLite.
Make, n8n, HighLevel: their inbound webhook trigger takes these as they are.
Zapier: Webhooks by Zapier (Catch Hook, on a paid Zapier plan) takes them today; a Frontmat app for Zapier is on its way.