Echo can POST every signal to your own https endpoint, for example an n8n or Zapier webhook, or your backend.
Connect
- In Settings, Integrations, click Connect on Your webhook.
- Enter a public https URL and click Check and connect.
- Echo shows a signing secret (
whsec_...) once. Save it, then click I saved it. - Click Send test to receive a sample event.
Events
| Event | When |
|---|---|
lead.engaged | A lead first becomes Engaged. |
lead.book | A lead clicks a booking link. |
lead.booked | A booking is confirmed by Cal.com or Calendly. |
lead.forward | A new browser opens a space someone already read. |
lead.return | A lead comes back to their space. |
Each request is a JSON POST with an Echo-Event-Id header (use it to ignore duplicates) and an Echo-Signature header.
Verify the signature
Echo-Signature looks like t=1760000000,v1=5f2c.... Compute an HMAC-SHA256 of t + "." + raw body with your signing secret and compare it to v1. Reject old timestamps to stop replays.
import crypto from "node:crypto";
export function verifyEcho(rawBody, header, secret, toleranceSec = 300) {
const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
const t = Number(parts.t);
if (!t || Math.abs(Date.now() / 1000 - t) > toleranceSec) return false;
const expected = crypto.createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");
return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1 || ""));
}Delivery and retries
Events are sent within about a minute. If your endpoint fails or times out, Echo retries after 2, 4, 8 and 16 minutes, then marks the event failed. Answer with any 2xx status quickly and do slow work afterwards.