API LeadForms для разработчиков

Authorization: Bearer ВАШ_КЛЮЧ

curl -H "Authorization: Bearer ВАШ_КЛЮЧ" "https://api.leadforms.ru/v1/me"

curl -H "Authorization: Bearer ВАШ_КЛЮЧ" "https://api.leadforms.ru/v1/leads?since_id=0&limit=10"

curl -X POST -H "Authorization: Bearer ВАШ_КЛЮЧ" -H "Content-Type: application/json" \
  -d '{"target_url":"https://example.com/leadforms","quiz_ids":[6903]}' \
  "https://api.leadforms.ru/v1/hooks"

function leadformsVerify(string $secret, string $body, string $header, int $tolerance = 300): bool
{
    $t = null; $sigs = [];
    foreach (explode(',', $header) as $part) {
        [$k, $v] = array_pad(explode('=', trim($part), 2), 2, '');
        if ($k === 't') { $t = (int) $v; } elseif ($k === 'v1') { $sigs[] = $v; }
    }
    if ($t === null || abs(time() - $t) > $tolerance) {
        return false;
    }
    $expected = hash_hmac('sha256', $t . '.' . $body, $secret);
    foreach ($sigs as $sig) {
        if (hash_equals($expected, $sig)) {
            return true;
        }
    }
    return false;
}

$body = file_get_contents('php://input');
if (!leadformsVerify('whsec_…', $body, $_SERVER['HTTP_X_LEADFORMS_SIGNATURE'] ?? '')) {
    http_response_code(401);
    exit;
}
$lead = json_decode($body, true);

const crypto = require('crypto');

function leadformsVerify(secret, rawBody, header, tolerance = 300) {
  let t = null; const sigs = [];
  for (const part of String(header || '').split(',')) {
    const [k, v] = part.trim().split('=');
    if (k === 't') t = Number(v); else if (k === 'v1') sigs.push(v);
  }
  if (!t || Math.abs(Date.now() / 1000 - t) > tolerance) return false;
  const expected = crypto.createHmac('sha256', secret).update(`${t}.${rawBody}`).digest('hex');
  return sigs.some((s) => s.length === expected.length && crypto.timingSafeEqual(Buffer.from(s), Buffer.from(expected)));
}

app.post('/leadforms', express.raw({ type: 'application/json' }), (req, res) => {
  if (!leadformsVerify(process.env.LEADFORMS_SECRET, req.body.toString('utf8'), req.get('X-Leadforms-Signature'))) {
    return res.sendStatus(401);
  }
  const lead = JSON.parse(req.body);
  res.sendStatus(200);
});

import hashlib, hmac, time

def leadforms_verify(secret: str, body: bytes, header: str, tolerance: int = 300) -> bool:
    t, sigs = None, []
    for part in (header or '').split(','):
        k, _, v = part.strip().partition('=')
        if k == 't' and v.isdigit():
            t = int(v)
        elif k == 'v1':
            sigs.append(v)
    if t is None or abs(time.time() - t) > tolerance:
        return False
    expected = hmac.new(secret.encode(), f'{t}.'.encode() + body, hashlib.sha256).hexdigest()
    return any(hmac.compare_digest(expected, s) for s in sigs)