/v1/* requests require these headers:
X-YoLead-Key: <publicKey>
X-YoLead-Timestamp: <unix_ms_timestamp>
X-YoLead-Signature: <hex_hmac_sha256>
<timestamp>.<raw_body>
raw_body is empty. The timestamp must be within a 5-minute window.
After YoLead verifies the signature, it checks whether the company’s current plan includes Public API access. A correctly signed request returns 403 with code 40351 when that access is unavailable.
For
POST and PATCH requests, sign the exact raw JSON string that you send as the request body. Do not parse and re-serialize JSON between signing and sending the request.import { createHmac } from "node:crypto";
function signYoLeadRequest(apiSecret: string, timestamp: string, rawBody: string) {
return createHmac("sha256", apiSecret)
.update(`${timestamp}.`)
.update(rawBody)
.digest("hex");
}
<?php
function signYoLeadRequest(string $apiSecret, string $timestamp, string $rawBody): string
{
return hash_hmac('sha256', $timestamp . '.' . $rawBody, $apiSecret);
}
Signing a JSON body
const publicKey = process.env.YOLEAD_PUBLIC_KEY!;
const apiSecret = process.env.YOLEAD_SECRET!;
const timestamp = Date.now().toString();
const payload = {
employeeId: "64f000000000000000000001",
chatId: "64f000000000000000000002",
capabilities: ["showChatPage"],
};
const rawBody = JSON.stringify(payload);
const signature = signYoLeadRequest(apiSecret, timestamp, rawBody);
const response = await fetch("https://api.yo-lead.com/v1/embed/sessions", {
method: "POST",
headers: {
"Content-Type": "application/json",
"X-YoLead-Key": publicKey,
"X-YoLead-Timestamp": timestamp,
"X-YoLead-Signature": signature,
},
body: rawBody,
});
console.log(await response.json());
<?php
$publicKey = getenv('YOLEAD_PUBLIC_KEY');
$apiSecret = getenv('YOLEAD_SECRET');
$timestamp = (string) round(microtime(true) * 1000);
$payload = [
'employeeId' => '64f000000000000000000001',
'chatId' => '64f000000000000000000002',
'capabilities' => ['showChatPage'],
];
$rawBody = json_encode($payload, JSON_UNESCAPED_SLASHES);
$signature = signYoLeadRequest($apiSecret, $timestamp, $rawBody);
$ch = curl_init('https://api.yo-lead.com/v1/embed/sessions');
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => $rawBody,
CURLOPT_HTTPHEADER => [
'Content-Type: application/json',
'X-YoLead-Key: ' . $publicKey,
'X-YoLead-Timestamp: ' . $timestamp,
'X-YoLead-Signature: ' . $signature,
],
]);
$body = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
if ($body === false) {
throw new RuntimeException(curl_error($ch));
}
curl_close($ch);
echo $status . PHP_EOL;
echo $body . PHP_EOL;