Read the data your widget collects — from any language.

const secret = process.env.CALLY_SECRET;

const res = await fetch('https://cally360.com/api/developer_api?action=leads&per_page=5', {
  headers: { 'Authorization': `Bearer ${secret}` }
});
const body = await res.json();

for (const lead of body.data.leads) {
  console.log(lead.full_name, lead.email);
  console.log(lead.widget_fields);
}

import os, requests

secret = os.environ["CALLY_SECRET"]

r = requests.get(
    "https://cally360.com/api/developer_api",
    params={"action": "leads", "per_page": 5},
    headers={"Authorization": f"Bearer {secret}"},
    timeout=10,
)
body = r.json()

for lead in body["data"]["leads"]:
    print(lead["full_name"], lead["email"])
    print(lead["widget_fields"])

curl -sS \
  -H "Authorization: Bearer $CALLY_SECRET" \
  "https://cally360.com/api/developer_api?action=leads&per_page=5" \
  | jq '.data.leads[] | {full_name, email, widget_fields}'

const deliveryId = payload.delivery_id;

await db.transaction(async (trx) => {
  const dup = await trx('processed_webhooks')
    .where({ delivery_id: deliveryId })
    .first();

  if (dup) {
    res.status(200).json({ stored: true, row_id: null });
    return;
  }

  await trx('processed_webhooks').insert({ delivery_id: deliveryId });

  const [rowId] = await trx('client_calls').insert({
    call_uuid: payload.data.call_uuid,
    caller_name: payload.data.caller_name,
  });

  res.status(200).json({ stored: true, row_id: rowId });
});

delivery_id = event["delivery_id"]

with engine.begin() as conn:
    dup = conn.execute(
        text("SELECT 1 FROM processed_webhooks WHERE delivery_id = :d"),
        {"d": delivery_id},
    ).fetchone()

    if dup:
        return {"stored": True, "row_id": None}

    conn.execute(
        text("INSERT INTO processed_webhooks (delivery_id) VALUES (:d)"),
        {"d": delivery_id},
    )

    result = conn.execute(
        text("INSERT INTO client_calls (call_uuid, caller_name) VALUES (:u, :n)"),
        {"u": event["data"]["call_uuid"], "n": event["data"]["caller_name"]},
    )

    return {"stored": True, "row_id": result.lastrowid}

import crypto from 'node:crypto';
import express from 'express';

const app = express();
const secret = process.env.CALLY_SIGNING_SECRET;

app.post('/hooks/cally360',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const header = req.get('X-Cally-Signature') || '';
    const rawBody = req.body.toString('utf8');

    const parts = Object.fromEntries(
      header.split(',').map(p => p.trim().split('='))
    );

    if (!parts.t || !parts.v1 || !/^\d+$/.test(parts.t)) {
      return res.status(400).send('bad signature header');
    }

    // Advisory window; never accept more than 600s.
    let tolerance = 300;
    if (parts.window && /^\d+$/.test(parts.window)) {
      tolerance = Math.min(Number(parts.window), 600);
    }

    if (Math.abs(Date.now() / 1000 - Number(parts.t)) > tolerance) {
      return res.status(400).send('timestamp out of window');
    }

    const expected = crypto
      .createHmac('sha256', secret)
      .update(`${parts.t}.${rawBody}`)
      .digest('hex');

    const ok = crypto.timingSafeEqual(
      Buffer.from(expected, 'hex'),
      Buffer.from(parts.v1,  'hex')
    );

    if (!ok) return res.status(401).send('invalid signature');

    const event = JSON.parse(rawBody);
    res.status(200).send('ok');
  }
);

import os, hmac, hashlib, time
from flask import Flask, request, abort

app = Flask(__name__)
SECRET = os.environ["CALLY_SIGNING_SECRET"].encode()

@app.post("/hooks/cally360")
def receive():
    raw_body = request.get_data()
    header   = request.headers.get("X-Cally-Signature", "")

    parts = dict(
        p.strip().split("=", 1) for p in header.split(",") if "=" in p
    )
    t, v1 = parts.get("t"), parts.get("v1")
    if not t or not v1 or not t.isdigit():
        abort(400, "bad signature header")

    tolerance = 300
    window = parts.get("window")
    if window and window.isdigit():
        tolerance = min(int(window), 600)

    if abs(time.time() - int(t)) > tolerance:
        abort(400, "timestamp out of window")

    expected = hmac.new(
        SECRET,
        f"{t}.".encode() + raw_body,
        hashlib.sha256,
    ).hexdigest()

    if not hmac.compare_digest(expected, v1):
        abort(401, "invalid signature")

    event = request.get_json(force=True)
    return "ok", 200

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "io"
    "net/http"
    "strconv"
    "strings"
    "time"
)

func WebhookHandler(secret string) http.HandlerFunc {
    return func(w http.ResponseWriter, r *http.Request) {
        raw, _ := io.ReadAll(r.Body)
        header := r.Header.Get("X-Cally-Signature")

        var t, v1 string
        var tolerance int64 = 300

        for _, p := range strings.Split(header, ",") {
            p = strings.TrimSpace(p)
            if strings.HasPrefix(p, "t=")      { t = p[2:] }
            if strings.HasPrefix(p, "v1=")     { v1 = p[3:] }
            if strings.HasPrefix(p, "window=") {
                if w, err := strconv.ParseInt(p[7:], 10, 64); err == nil && w > 0 && w <= 600 {
                    tolerance = w
                }
            }
        }

        ts, err := strconv.ParseInt(t, 10, 64)
        if err != nil {
            http.Error(w, "bad header", 400)
            return
        }

        if diff := time.Since(time.Unix(ts, 0)); diff > time.Duration(tolerance)*time.Second && -diff > time.Duration(tolerance)*time.Second {
            http.Error(w, "out of window", 400)
            return
        }

        mac := hmac.New(sha256.New, []byte(secret))
        mac.Write([]byte(t))
        mac.Write([]byte("."))
        mac.Write(raw)
        expected := hex.EncodeToString(mac.Sum(nil))

        if !hmac.Equal([]byte(expected), []byte(v1)) {
            http.Error(w, "invalid", 401)
            return
        }

        w.WriteHeader(200)
        _, _ = w.Write([]byte("ok"))
    }
}

export class Cally360Client {
  #secret; #baseUrl;

  constructor(secret, baseUrl = 'https://cally360.com/api/developer_api') {
    if (!secret?.startsWith('cally_live_sk_'))
      throw new Error('Secret must start with cally_live_sk_');
    this.#secret = secret;
    this.#baseUrl = baseUrl;
  }

  async #get(action, params = {}) {
    const url = new URL(this.#baseUrl);
    url.search = new URLSearchParams({ action, ...params });

    const res = await fetch(url, {
      headers: { 'Authorization': `Bearer ${this.#secret}` },
      signal: AbortSignal.timeout(15_000),
    });
    const body = await res.json();
    if (!res.ok || body.success !== true)
      throw new Error(`Cally360 [${body.error_code}]: ${body.message}`);
    return body;
  }

  leads({ perPage = 5, page = 1 } = {}) {
    return this.#get('leads', { per_page: perPage, page });
  }
}

const client = new Cally360Client(process.env.CALLY_SECRET);
const { data } = await client.leads();
for (const lead of data.leads) {
  console.log(`${lead.full_name} <${lead.email}>`, lead.widget_fields);
}

import os, requests

class Cally360Client:
    def __init__(self, secret, base_url="https://cally360.com/api/developer_api"):
        if not secret.startswith("cally_live_sk_"):
            raise ValueError("Secret must start with cally_live_sk_")
        self._secret, self._base_url = secret, base_url

    def _get(self, action, **params):
        r = requests.get(
            self._base_url,
            params={"action": action, **params},
            headers={"Authorization": f"Bearer {self._secret}"},
            timeout=15,
        )
        body = r.json()
        if r.status_code >= 400 or not body.get("success"):
            raise RuntimeError(f"Cally360 [{body.get('error_code')}]: {body.get('message')}")
        return body

    def leads(self, per_page=5, page=1):
        return self._get("leads", per_page=per_page, page=page)

client = Cally360Client(os.environ["CALLY_SECRET"])
for lead in client.leads()["data"]["leads"]:
    print(f"{lead['full_name']} <{lead['email']}>", lead["widget_fields"])

package cally360

import (
    "context"; "encoding/json"; "fmt"
    "net/http"; "net/url"; "strings"; "time"
)

const defaultBase = "https://cally360.com/api/developer_api"

type Client struct {
    secret, baseURL string
    http *http.Client
}

func NewClient(secret string) (*Client, error) {
    if !strings.HasPrefix(secret, "cally_live_sk_") {
        return nil, fmt.Errorf("secret must start with cally_live_sk_")
    }
    return &Client{secret, defaultBase, &http.Client{Timeout: 15 * time.Second}}, nil
}

type envelope struct {
    Success   bool            `json:"success"`
    Message   string          `json:"message"`
    ErrorCode string          `json:"error_code"`
    Data      json.RawMessage `json:"data"`
}

func (c *Client) get(ctx context.Context, action string, p url.Values) ([]byte, error) {
    p.Set("action", action)
    req, _ := http.NewRequestWithContext(ctx, "GET", c.baseURL+"?"+p.Encode(), nil)
    req.Header.Set("Authorization", "Bearer "+c.secret)

    res, err := c.http.Do(req)
    if err != nil { return nil, err }
    defer res.Body.Close()

    var env envelope
    if err := json.NewDecoder(res.Body).Decode(&env); err != nil { return nil, err }
    if res.StatusCode >= 400 || !env.Success {
        return nil, fmt.Errorf("cally360 [%s]: %s", env.ErrorCode, env.Message)
    }
    return env.Data, nil
}

type Lead struct {
    FullName     string            `json:"full_name"`
    Email        string            `json:"email"`
    WidgetFields map[string]string `json:"widget_fields"`
}

func (c *Client) Leads(ctx context.Context) ([]Lead, error) {
    raw, err := c.get(ctx, "leads", url.Values{"per_page": {"5"}})
    if err != nil { return nil, err }
    var d struct{ Leads []Lead `json:"leads"` }
    return d.Leads, json.Unmarshal(raw, &d)
}

require 'net/http'; require 'json'; require 'uri'

module Cally360
  class Client
    BASE_URL = 'https://cally360.com/api/developer_api'

    def initialize(secret, base_url: BASE_URL)
      raise ArgumentError, 'Secret must start with cally_live_sk_' unless secret.start_with?('cally_live_sk_')
      @secret, @base_url = secret, base_url
    end

    def leads(per_page: 5, page: 1)
      get('leads', per_page: per_page, page: page)
    end

    private

    def get(action, **params)
      params[:action] = action
      uri = URI(@base_url); uri.query = URI.encode_www_form(params.compact)
      http = Net::HTTP.new(uri.host, uri.port)
      http.use_ssl = uri.scheme == 'https'
      http.read_timeout = 15

      req = Net::HTTP::Get.new(uri)
      req['Authorization'] = "Bearer #{@secret}"
      res = http.request(req)
      body = JSON.parse(res.body)

      raise "Cally360 [#{body['error_code']}]: #{body['message']}" unless body['success'] == true
      body
    end
  end
end

client = Cally360::Client.new(ENV.fetch('CALLY_SECRET'))
client.leads['data']['leads'].each do |l|
  puts "#{l['full_name']} <#{l['email']}> #{l['widget_fields']}"
end

import crypto from 'node:crypto';
import express from 'express';

const app = express();
const SECRET = process.env.CALLY_SIGNING_SECRET;

app.post('/hooks/cally360',
  express.raw({ type: 'application/json' }),
  async (req, res) => {
    const rawBody = req.body.toString('utf8');
    const header  = req.get('X-Cally-Signature') ?? '';

    const parts = Object.fromEntries(header.split(',').map(p => p.trim().split('=')));
    if (!parts.t || !parts.v1 || !/^\d+$/.test(parts.t))
      return res.status(400).send('bad header');
    if (Math.abs(Date.now() / 1000 - Number(parts.t)) > 300)
      return res.status(400).send('out of window');

    const expected = crypto.createHmac('sha256', SECRET)
      .update(`${parts.t}.${rawBody}`).digest('hex');

    const ok = crypto.timingSafeEqual(
      Buffer.from(expected, 'hex'),
      Buffer.from(parts.v1,  'hex'),
    );
    if (!ok) return res.status(401).send('invalid');

    const event = JSON.parse(rawBody);
    // ... process event, insert to your DB ...
    const rowId = 4321;

    res.status(200).json({ stored: true, row_id: rowId });
  });

import os, hmac, hashlib, time, json
from fastapi import FastAPI, Request, HTTPException, Response

app = FastAPI()
SECRET = os.environ["CALLY_SIGNING_SECRET"].encode()

@app.post("/hooks/cally360")
async def receive(request: Request):
    raw = await request.body()
    header = request.headers.get("X-Cally-Signature", "")

    parts = dict(p.strip().split("=", 1) for p in header.split(",") if "=" in p)
    t, v1 = parts.get("t"), parts.get("v1")
    if not t or not v1 or not t.isdigit() or abs(time.time() - int(t)) > 300:
        raise HTTPException(400, "bad header")

    expected = hmac.new(SECRET, f"{t}.".encode() + raw, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, v1):
        raise HTTPException(401, "invalid signature")

    event = json.loads(raw)
    # ... process event, insert to your DB ...
    row_id = 4321

    return {"stored": True, "row_id": row_id}

import (
    "crypto/hmac"; "crypto/sha256"; "encoding/hex"
    "encoding/json"; "io"; "net/http"; "strconv"
    "strings"; "time"
)

func WebhookHandler(secret string) http.HandlerFunc {
    return func(w http.ResponseWriter, r *http.Request) {
        raw, _ := io.ReadAll(r.Body)
        header := r.Header.Get("X-Cally-Signature")

        var t, v1 string
        for _, p := range strings.Split(header, ",") {
            p = strings.TrimSpace(p)
            if strings.HasPrefix(p, "t=")  { t  = p[2:] }
            if strings.HasPrefix(p, "v1=") { v1 = p[3:] }
        }
        ts, err := strconv.ParseInt(t, 10, 64)
        if err != nil || time.Since(time.Unix(ts, 0)) > 5*time.Minute {
            http.Error(w, "bad header", 400); return
        }

        mac := hmac.New(sha256.New, []byte(secret))
        mac.Write([]byte(t)); mac.Write([]byte(".")); mac.Write(raw)
        expected := hex.EncodeToString(mac.Sum(nil))

        if !hmac.Equal([]byte(expected), []byte(v1)) {
            http.Error(w, "invalid", 401); return
        }

        var event map[string]any
        _ = json.Unmarshal(raw, &event)

        w.Header().Set("Content-Type", "application/json")
        w.WriteHeader(200)
        _, _ = w.Write([]byte(`{"stored":true,"row_id":4321}`))
    }
}

require 'openssl'; require 'json'; require 'sinatra'

post '/hooks/cally360' do
  raw    = request.body.read
  header = request.env['HTTP_X_CALLY_SIGNATURE'].to_s
  secret = ENV.fetch('CALLY_SIGNING_SECRET')

  parts = header.split(',').each_with_object({}) do |p, acc|
    k, v = p.strip.split('=', 2); acc[k] = v if k && v
  end
  t, v1 = parts['t'], parts['v1']
  halt 400, 'bad header' unless t && v1 && t.match?(/\A\d+\z/)
  halt 400, 'out of window' if (Time.now.to_i - t.to_i).abs > 300

  expected = OpenSSL::HMAC.hexdigest('SHA256', secret, "#{t}.#{raw}")
  halt 401, 'invalid' unless OpenSSL.secure_compare(expected, v1)

  event = JSON.parse(raw)
  # ... process event, insert to your DB ...
  row_id = 4321

  content_type :json
  status 200
  { stored: true, row_id: row_id }.to_json
end