Build on LeadScout

curl https://app.leadscoutapp.com/api/v1/account \
  -H "Authorization: Bearer $LEADSCOUT_API_KEY"

{
  "data": {
    "organization": {
      "id": "3f6c1a9e-2b7d-4c1e-9a55-8e0d4b2f7c61",
      "name": "Lakeshore Roofing",
      "slug": "lakeshore-roofing"
    },
    "credential": { "type": "api_key", "name": "HubSpot sync" },
    "scopes": ["prospects:read", "prospects:write"],
    "actor": { "id": "1204", "name": "HubSpot sync (API)" }
  }
}

curl https://app.leadscoutapp.com/api/v1/prospects \
  -H "Authorization: Bearer $LEADSCOUT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Jordan Rivera",
    "phoneNumber": "+1 616-555-0142",
    "location": { "lat": 42.9634, "lng": -85.6681 },
    "address": {
      "line1": "120 Fulton St W",
      "city": "Grand Rapids",
      "state": "MI",
      "zip": "49503"
    },
    "source": "hubspot",
    "sourceId": "90210"
  }'

import crypto from 'node:crypto'

// Keep verifier and state in the user's session until the callback.
const verifier = crypto.randomBytes(32).toString('base64url')
const challenge = crypto.createHash('sha256').update(verifier).digest('base64url')
const state = crypto.randomBytes(16).toString('base64url')

const url = new URL('https://app.leadscoutapp.com/oauth/authorize')
url.search = new URLSearchParams({
  response_type: 'code',
  client_id: process.env.LEADSCOUT_CLIENT_ID,
  redirect_uri: 'https://yourapp.com/leadscout/callback',
  scope: 'prospects:read prospects:write',
  state,
  code_challenge: challenge,
  code_challenge_method: 'S256',
}).toString()

// Redirect the user to url.

https://yourapp.com/leadscout/callback?code=lsc_...&state=...

curl https://app.leadscoutapp.com/api/oauth/token \
  -u "$LEADSCOUT_CLIENT_ID:$LEADSCOUT_CLIENT_SECRET" \
  -d grant_type=authorization_code \
  -d code="$CODE" \
  -d redirect_uri="https://yourapp.com/leadscout/callback" \
  -d code_verifier="$VERIFIER"

{
  "access_token": "lsa_...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "lsr_...",
  "scope": "prospects:read prospects:write"
}

curl https://app.leadscoutapp.com/api/oauth/token \
  -u "$LEADSCOUT_CLIENT_ID:$LEADSCOUT_CLIENT_SECRET" \
  -d grant_type=refresh_token \
  -d refresh_token="$REFRESH_TOKEN"

curl https://app.leadscoutapp.com/api/oauth/revoke \
  -u "$LEADSCOUT_CLIENT_ID:$LEADSCOUT_CLIENT_SECRET" \
  -d token="$REFRESH_TOKEN"

{
  "data": [ { "id": "10234", "updatedAt": "2026-09-28T14:03:11.482Z", ... } ],
  "meta": { "hasMore": true, "nextCursor": "MjAyNi0wOS0yOFQxNDowMzoxMS40ODJafDEwMjM0" }
}

const BASE = 'https://app.leadscoutapp.com/api/v1'

// since: the checkpoint you saved last run (null the first time).
async function syncProspects(since) {
  let cursor = null
  let checkpoint = since
  do {
    const url = new URL(`${BASE}/prospects`)
    url.searchParams.set('limit', '100')
    url.searchParams.set('include_deleted', 'true')
    if (since) url.searchParams.set('updated_after', since)
    if (cursor) url.searchParams.set('cursor', cursor)

    const res = await fetch(url, {
      headers: { Authorization: `Bearer ${process.env.LEADSCOUT_API_KEY}` },
    })
    const body = await res.json()
    if (!res.ok) throw new Error(`${body.error.code}: ${body.error.message}`)

    for (const prospect of body.data) {
      if (prospect.deletedAt) await deleteLocal(prospect.id)
      else await upsertLocal(prospect) // keyed by id, so replays are harmless
      checkpoint = prospect.updatedAt
    }
    cursor = body.meta.nextCursor
  } while (cursor)

  return checkpoint // save it, pass it back next run
}

{
  "error": {
    "code": "validation_failed",
    "message": "The request body is invalid",
    "requestId": "req_4f1d9c2b7a6e48d3b0c5e1f2a3b4c5d6",
    "details": [
      { "field": "location.lat", "reason": "Number must be less than or equal to 90" }
    ]
  }
}

curl https://app.leadscoutapp.com/api/v1/webhooks \
  -H "Authorization: Bearer $LEADSCOUT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://yourapp.com/leadscout/webhooks",
    "events": ["prospect.created", "prospect.updated", "prospect.status_changed"]
  }'

POST /leadscout/webhooks
Content-Type: application/json
X-LeadScout-Event-Id: evt_7d1c2f0a9b8e4c55a1f3e2d4c6b8a0e1
X-LeadScout-Timestamp: 1790000000
X-LeadScout-Signature: v1=5f2b7c3e9a1d...

{
  "id": "evt_7d1c2f0a9b8e4c55a1f3e2d4c6b8a0e1",
  "type": "prospect.status_changed",
  "occurredAt": "2026-09-28T14:03:11.482Z",
  "organizationId": "3f6c1a9e-2b7d-4c1e-9a55-8e0d4b2f7c61",
  "origin": "app",
  "credential": null,
  "data": { "id": "10234", "status": { "id": "12", "name": "Interested", "category": "engaged" }, ... }
}

import crypto from 'node:crypto'
import express from 'express'

const app = express()
const SECRET = process.env.LEADSCOUT_WEBHOOK_SECRET

// express.raw keeps the exact bytes. Parsing first breaks the signature.
app.post('/leadscout/webhooks', express.raw({ type: 'application/json' }), (req, res) => {
  const timestamp = req.get('X-LeadScout-Timestamp')
  const signature = req.get('X-LeadScout-Signature') ?? ''
  const eventId = req.get('X-LeadScout-Event-Id')

  // 1. Reject stale deliveries (older than 5 minutes).
  const age = Math.abs(Date.now() / 1000 - Number(timestamp))
  if (!timestamp || !(age <= 300)) return res.sendStatus(400)

  // 2. Recompute the signature over "<timestamp>.<raw body>".
  const expected = Buffer.from(
    'v1=' +
      crypto.createHmac('sha256', SECRET).update(`${timestamp}.`).update(req.body).digest('hex'),
  )
  // The header can hold several comma-separated signatures. Any match passes.
  const valid = signature.split(',').some((part) => {
    const candidate = Buffer.from(part.trim())
    return candidate.length === expected.length && crypto.timingSafeEqual(candidate, expected)
  })
  if (!valid) return res.sendStatus(401)

  // 3. Acknowledge fast, then process. Dedupe on the event id.
  res.sendStatus(200)
  const event = JSON.parse(req.body.toString('utf8'))
  enqueue(eventId, event)
})