# Send every lead to where your team already works

> Leads from form tools, your server, the hosted form and native lead forms go to any mix of your CRM, Slack, Google Sheets, a signed webhook, e-mail alerts and your existing form endpoint, with retries and a log that never stores lead details.

A conversion that carries a person’s details becomes a lead, wherever it happened: a form tool on your site, your own backend, the Demander-hosted form, a Meta Instant Form or a LinkedIn Lead Gen Form. Lead forwarding sends it to as many destinations as you set up, with only the fields the person gave.

## Destinations

| Destination | What arrives | Setup |
| --- | --- | --- |
| Your CRM | A contact, the company when the e-mail has a business domain, and a note naming the conversion | HubSpot, Pipedrive or Salesforce connected under [CRM](https://demander.to/platforms/crm/) |
| Slack | A message with the lead’s fields, the conversion, the campaign and the source | A Slack incoming webhook URL, stored encrypted |
| Google Sheets | One row per lead, lined up by column name | Sign in with Google (drive.file only); Demander creates the spreadsheet |
| Webhook | Signed JSON with the lead, the conversion, the campaign and the source | Any https URL; a signing secret shown once |
| Your form endpoint | A server-side POST, form-encoded or JSON, with an optional auth header | The URL your current forms post to, plus a field mapping |
| E-mail | A notification with the lead’s fields and a link to the Conversions page | Up to 10 recipients |

## Where leads come from

- **Form and booking tools.** Typeform, Tally, Jotform, Calendly, Cal.com and any tool that can send a signed webhook. Cancelled bookings cancel the conversion they name.
- **Your own server.** The server events API, with the lead fields your backend already has and an event id that makes retries harmless.
- **The Demander-hosted form.** It asks only for the fields you list, with a honeypot, rate limits and the ad’s UTM parameters in hidden fields.
- **Native lead forms.** Meta Instant Forms and LinkedIn Lead Gen Forms that Demander created at publish, read every 15 minutes with the ad and campaign behind each lead.

## How a delivery runs

1. **Filtered.** A route forwards every conversion that has lead details, or only the conversions you pick.
2. **Minimised.** Only the fields the person gave at that conversion are sent. A field mapping renames them to your names and can narrow them further, up to 40 mapped fields.
3. **Retried.** A failed delivery is retried after 1, 5 and 30 minutes, then 2 and 12 hours, 6 attempts in all. A permanent 4xx error stops it at once.
4. **Logged without values.** The delivery log keeps the status, attempts, response codes and field names, never the values.
5. **Live only.** Outside live mode nothing is forwarded automatically. “Send test” always sends, so you can check a route before you go live.

## What a webhook receives

```json
{
  "type": "lead.created",
  "id": "4f1c9a2e",
  "delivery": "b7d03e51",
  "occurred_at": "2026-10-02T09:14:05.000Z",
  "test": false,
  "conversion": { "name": "Demo booked", "key": "demo_booked", "kind": "booking", "stage": "sql", "value": 0, "currency": "EUR" },
  "campaign": { "id": "c2a8", "name": "CFO, LinkedIn, conversion", "platform": "linkedin_ads" },
  "source": "lead_form:linkedin",
  "lead": { "email": "jana@acme.cz", "full_name": "Jana Novak", "company": "Acme s.r.o.", "job_title": "CFO", "conversion": "Demo booked" }
}
```

Shortened example. Headers: X-Demander-Signature (t=<unix time>,v1=<hex HMAC-SHA256 of "t.body">) and X-Demander-Delivery, a unique id per delivery for dropping duplicates.

## Google Sheets details

- **Only its own spreadsheets.** With Google’s drive.file scope Demander reaches the spreadsheets it created for your leads and nothing else in your Drive.
- **Columns by name.** Rows line up with the header by column name, so you can reorder columns or add your own. A new field gets a new column at the end.
- **Text stays text.** Values are written raw, so something a lead typed, such as a formula, is stored as text and never runs.
- **Clear failures.** If the spreadsheet is deleted or access is removed, the delivery stops with the reason in the log.

> **Keeping your existing form handling.** If your marketing automation already processes your website form, point a form endpoint route at the same URL. Leads from Meta and LinkedIn lead forms then arrive through the path your forms already use, mapped to your field names.

## Questions

**Can one lead go to several places at once?**

Yes. Routes are independent, so one lead can create a CRM contact, post to Slack and add a row to a Google Sheet.

**How do we verify the webhook?**

Recompute the HMAC-SHA256 of the timestamp, a full stop and the raw body with your signing secret, compare it in constant time and reject old timestamps. Use the delivery id to drop duplicates when a retry arrives.

**What happens if our endpoint is down?**

Demander retries after 1, 5 and 30 minutes, 2 hours and 12 hours. After the sixth failed attempt the delivery stops, and the log shows the last response code.

**Does a lead need a CRM to be useful?**

No. Any route works on its own, and the lead still counts as a conversion in Demander’s attribution. When the company is known, its account also moves to the funnel stage that conversion stands for.

## Related

- [Conversion tracking](https://demander.to/features/conversion-tracking/)
- [CRM](https://demander.to/platforms/crm/)
- [Meta (Facebook and Instagram)](https://demander.to/platforms/meta/)
- [LinkedIn Ads](https://demander.to/platforms/linkedin/)
- [API and MCP](https://demander.to/features/api-and-mcp/)

---
Source: https://demander.to/platforms/lead-destinations/ · Demander · reviewed 2026-10-02