Features

Integrations

Quattora connects to other tools through API keys, outbound webhooks, and your Gmail account. The Lead Capture API accepts new leads from any tool that can send a web request, with no special software.

API keys

Plan: Studio for website-form keys, Team for server-integration keys. Owners and admins manage keys in the workspace under Settings, then Integrations, then API keys. An admin whose role is limited can create and revoke website-form keys only.

• Keys are stored as SHA-256 hashes, so the raw key is shown only once, when you create it
• Each key belongs to one workspace and shows when it was last used
• Keys can be revoked at any time. A revoked key stops working immediately and stays listed as revoked
• A key works only while the workspace's plan includes what it is for. After a move to a smaller plan, a call the plan no longer covers answers 403, and the same key works again once the plan includes it

Two kinds of key: a website form key can only send in new leads, so it is safe in the code of a web page. A server integration key has full access to your CRM, team costs and hours, so keep it on your server and never in a web page.

Creating a key: in the workspace, open Settings, then Integrations, then API keys, and choose Generate new API key. Say what the key is for, then copy it (it is not shown again). Send it in an Authorization: Bearer {KEY} or X-Api-Key: {KEY} header.

Limits: one key may make at most 120 requests a minute, and each workspace has a monthly allowance of API calls that depends on its plan. Over either limit the answer is 429.

Using the key:

curl -X POST https://your-app.com/api/lead-capture \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Jane Doe",
    "email": "jane@example.com",
    "company": "Acme Corp",
    "source": "zapier"
  }'

Lead Capture API (inbound)

Plan: Studio. Endpoint: POST /api/lead-capture. Either kind of key works.

Fields: send a JSON object.

• name (required): at least 2 characters.
• email (required): a valid address.
• source: free text up to 64 characters, kept as you send it (for example Google Ads). Left out, it is website.
• rating: hot, warm or cold. Left out, the lead is not rated. The field's older name still works too.
• company, phone and notes: optional text.

A new lead answers 200 with { "success": true, "id": "uuid" }.

Retrying safely: add an Idempotency-Key header. A retry with the same key returns the first lead instead of creating a second, and the answer carries Idempotent-Replayed: true.

Zapier, n8n and Make: use a Webhooks or HTTP Request node. POST to the endpoint with Authorization: Bearer YOUR_KEY and the JSON body above.

Outbound webhooks

Plan: Team. Manage webhooks under Integrations in your workspace settings (owners and admins only).

Events sent: a webhook receives the events you subscribe it to. These are the events that exist today:

• deal.won
• deal.lost
• deal.stage_changed
• lead.created
• contact.created
• invoice.sent
• invoice.paid
• bill.approved
• smart_file.accepted
• smart_file.declined

Each delivery is an HTTP POST with a JSON body (Content-Type: application/json). The body has three fields: event (the event id), payload (the event's data) and timestamp (when the delivery was created). Every try of one delivery sends the same body.

Payload format:

{
  "event": "deal.won",
  "payload": {
    "dealId": "deal_test_123",
    "title": "Test deal",
    "stage": "won",
    "reason": "Best fit for the brief"
  },
  "timestamp": "2026-03-24T12:00:00.000Z"
}

Headers: every delivery carries these headers:

Test ping: the Test button in your webhook settings sends one ping that is built like a delivery, with three differences. It carries the header X-Webhook-Test set to true. Its body has a fourth field, isTest, also true. And it has no X-Webhook-Delivery header, because a test ping is not a delivery and cannot be replayed. It is signed like a delivery when the webhook has a secret.

Signature verification: when a webhook has a signing secret, Quattora adds an X-Webhook-Signature header. To check it, sign the raw body yourself and compare:

const expected = `sha256=${createHmac('sha256', secret).update(rawBody).digest('hex')}`;
const isValid = timingSafeEqual(Buffer.from(expected), Buffer.from(received));

Gmail

Plan: Studio. Each person connects their own Gmail account in the workspace under Settings, then Account, then Email. Viewers cannot connect one.

Send email to your contacts, leads and deals from Quattora, from your own Gmail address. Each email is logged on the record's timeline, and replies arrive in your own inbox.

Setting it up:

1. In the workspace, open Settings, then Account, then Email, and choose Connect Gmail
2. Sign in with Google and allow what Quattora asks for (listed below). Disconnect on the same page ends the connection
3. Open a contact, lead or deal and send an email. It goes out from your Gmail address and is logged on the timeline

What Quattora asks Google for:

• Sending email from your address, only when you send from Quattora
• Your Gmail address, to show which account is connected
• Creating, changing and cancelling a Google Calendar event with a Google Meet link when you schedule a meeting in Quattora
• The times you are busy, so your booking page offers only free times. Titles, guests and places are not read, and the times are not stored

What Quattora does not do: it does not read your inbox. To log a reply on a contact's timeline, BCC or forward it to your workspace's log address, listed on the same Email page.