HubSpot Setup Guide
Follow these 6 steps to activate your DangWire automation on HubSpot.
Create Your HubSpot Account
Sign up for free at hubspot.com. The free CRM tier includes contacts, companies, deals, and forms — enough to run lead pipelines without a paid plan.
Connect HubSpot in DangWire
In your DangWire dashboard, open Settings → Integrations, select HubSpot, and click Connect. Complete the HubSpot OAuth consent screen for the portal you want leads written to.
Map Form Fields to CRM Properties
Match each form field to the target contact, company, or deal property. Custom enterprise properties must already exist in HubSpot — create them before mapping.
Set Up Follow-Up Workflows
In HubSpot, build the follow-up sequence (deal stage updates, task assignment, or email nurture) triggered by the new contact record your form creates.
Test with a Sample Submission
Submit a test form and confirm the contact appears with every mapped property, the right owner, and the follow-up workflow entered.
Go Live
Once the test contact flows through correctly, the integration is live: every new form submission creates or updates a CRM record automatically.
HubSpot status callbacks (optional)
Ask HubSpot to POST build and delivery status back to DangWire so your order progress updates in real time. Callbacks are authenticated — unauthenticated requests are rejected in production.
- 1
Point HubSpot at the callback URL
Configure the webhook or HTTP action to POST to:
https://dangwire.com/platform-callbacks/hubspot - 2
Authenticate the callback
HubSpot signs every webhook delivery automatically with your private app's client secret (X-HubSpot-Signature-v3 plus a timestamp — DangWire also accepts the older v2 signature). Nothing extra is needed on the HubSpot side beyond registering the callback URL. Your secret is your private app's client secret.
Your secret is your private app's client secret.
- 3
Mirror the secret on DangWire
Set
HUBSPOT_WEBHOOK_SECRETto the same value. Leave it unset on local dev (callbacks are accepted with a warning); production rejects callbacks without it.
Verify webhook signatures
Every forward DangWire sends to your automation URL is HMAC-signed so you can prove it came from us and was not tampered with in transit. The dashboard Test button sends the exact same signed shape, so you can validate your verification logic before going live. Verification is optional — unsigned requests are still delivered — but recommended for production endpoints.
| Header | Meaning |
|---|---|
X-Webhook-Signature | Hex-encoded HMAC-SHA256 digest over `{timestamp}.{raw_body}` using your workflow's signing secret. |
X-Webhook-Timestamp | Unix seconds (string) when the request was signed. Reject anything older than 5 minutes to block replays. |
X-Webhook-Event | Event type — `form_submission` for live submissions and manual test probes alike. |
Verification recipe
- Read the raw request body before JSON parsing — the signature covers the exact bytes on the wire.
- Compute
expected = HMAC_SHA256(secret, timestamp + "." + raw_body)and compare it toX-Webhook-Signaturein constant time. - Reject when
X-Webhook-Timestampis more than 5 minutes old (replay window) or the digest does not match.
import { createHmac, timingSafeEqual } from "crypto";
function verifyDangWire(secret, rawBody, timestamp, signature) {
const expected = createHmac("sha256", secret)
.update(timestamp + "." + rawBody)
.digest("hex");
const ok = timingSafeEqual(
Buffer.from(expected, "hex"),
Buffer.from(signature, "hex"),
);
const fresh = Math.abs(Date.now() / 1000 - Number(timestamp)) <= 300;
return ok && fresh;
}Your signing secret (whsec_…) is per workflow. Read it once from the dashboard integration settings or the management API (GET /api/webhook-signing/workflows/<id>), store it in your platform's credential vault, and rotate it there when needed (POST …/rotate) — rotation invalidates old signatures immediately.