Capturing leads from web forms

You send website form leads into Stravax Engage by posting to a public leads endpoint with a form key unique to your organization. The lead lands on your CRM pipeline board in the intake stage, tagged with source "web form," and any extra fields your form collects are kept alongside it.

Where do I find my web form key?

An admin can open Settings > Connections > Website leads key to create or replace the key. In the earlier look, the key is in the Connections dialog on the CRM page.

How do I keep my web form key safe?

The key identifies your workspace. Keep it server-side where you can, and rotate it if it leaks. An admin can rotate it from Connections.

How do I submit a lead?

Post the form fields to the public leads endpoint, passing your key either as an x-engage-form-key header or a key field in the body:

curl -X POST https://app.stravax.ai/api/public/leads \
  -H "x-engage-form-key: YOUR_FORM_KEY" \
  -H "content-type: application/json" \
  -d '{"name":"Jane Doe","phone":"0501234567","email":"jane@example.com"}'

The endpoint resolves your organization from the key itself, never from anything else in the request body. The response is a neutral {"ok":true} or {"ok":false}, so it does not reveal whether a failure was a bad key or something else; the one distinguishable response is a standard 429 when a sender is submitting too fast. If leads are not arriving, check the key configured in your form against the one shown in Connections.

What happens to the fields I send?

The lead is created with:

• Phone normalized where possible (for example, a local number is converted to E.164 format)
• Standard fields (name, email, company) mapped onto the lead record
• Any other fields you send kept as custom fields on the lead, so a budget or interest field from your form is preserved even if it is not a standard CRM field
• Source set to "web form"
• Stage set to intake, the default starting stage

If the phone number matches an existing WhatsApp contact for your organization, the lead is linked to that contact automatically. See Leads, pipelines and timelines for how the lead record and its timeline work from there.

Is the endpoint rate limited?

Yes. Submissions are limited per key to protect your form from spam and abuse: a request budget per minute and a larger budget per day. Going over the limit returns a "too many requests" response with a retry delay; legitimate traffic from a normal contact form stays well under it. The limit is enforced before your organization is even resolved, so it also caps abuse against an incorrect or guessed key.

Field limits

Field values and the number of custom fields you can send are capped to keep a single malformed or abusive submission from bloating a lead record. Keep form fields to reasonable, human-entered lengths (names, short text answers, a phone number) rather than pasting large blocks of text.

Related

• Leads, pipelines and timelines
• Moving a lead through stages

Website identity v1 preview

This integration is pending release and site authorization. Existing forms keep their current submission contract. Do not enable new collection until your controller has approved the site policy, notice and retention instructions.

The shared collector exposes an asynchronous stravaxTrack.collect(collector) and an explicit setConsent() hook for your site's consent manager. Await the collector at submit time. Pass its optional v1 identity as attribution; hosted embeds request fresh parent-page evidence through an origin, source and nonce checked message handshake. Form answers never go into that handshake or URL. Unknown or denied measurement permission still permits a normal lead submission.

The server checks the installation, allowed origin and provider permission again. Request IP and user agent come from the request, never JSON fields. A supported custom form can supply a separate explicit measurement assertion even when it has no click attribution; without that assertion and an enabled server policy, the new path stores no measurement context. Service or marketing opt-in does not grant advertising permission.

Individual IDs have a 2,048-character local limit, supplied cookies 2,304, and the optional v1 identity has a 4,096-byte wire limit. Whole invalid fields or packs are omitted, never shortened into another identifier. A valid form within its existing body cap remains usable when optional evidence is omitted. Collection does not promise campaign credit or provider acceptance.

Withdrawal clears Engage-owned browser measurement immediately. A server withdrawal can remain pending while offline; use retryWithdrawal() and inspect withdrawalState(). Pixel cookies are left to their owner. Capability-free legacy inputs use your verified controller rights process.