1. Create a key per provider
In Settings → Lead Capture, add a key and name it after the vendor. The key is shown once and stored only as a fingerprint, so nobody — including us — can read it back afterwards.
Lead provider API
Auto transport lead provider API
Give each lead provider their own key, and their leads land in your pipeline the moment they are generated — tagged with the vendor that sent them, de-duplicated, and with ZIP codes already resolved into a real route. Included in the plan, with no per-lead fee.
Typing leads in is where the good ones get lost
Most brokerages buy leads as well as earning them, and the handover is usually the worst part of the day. A vendor emails a CSV overnight and somebody pastes it in by hand. A customer already in the pipeline gets entered a second time. A ZIP code arrives with no city or state, so the route column reads 75201. And three months later nobody can say which vendor actually produced paying customers, so every contract gets renewed.
How it works
Three steps, and the work is on their side
You create a key and send a link. Your provider's developer does the rest, and needs nothing further from you or from us.
2. Send them the guide
Beside every key is an integration guide: the address to post to, the authentication header, a working example, every field accepted and every response returned. Send that page to the provider.
3. Leads arrive ready to work
Tagged with the provider's name, routed, de-duplicated, and sitting in your Leads tab ready to quote. Nobody retypes a phone number at 7am.
One key per provider is the point: it is what lets you see which vendor sent what, and switch one off without disturbing the others.
What the integration actually does for you
Bought leads arrive quietly
A provider can deliver two hundred leads in one burst. If every one buzzed your phone you would switch notifications off within a week, and then miss the ones that matter — like a signed order landing. So provider leads do not raise alerts. They queue in your Leads tab to be worked, while leads from your own website notify you exactly as they always did. That is a deliberate decision, not an oversight.
The same person never lands twice
Every provider retries after a network hiccup. A repeat is caught two ways: by the provider's own lead ID, so a retry storm cannot create a hundred copies, and by the person, so the same email or phone inside 24 hours is merged into the existing lead rather than creating a rival record.
ZIP codes become real routes
Providers vary wildly in what they send. Some give a full address, some give five digits. Send 75201 and 33101 and the lead reads Dallas, TX → Miami, FL, with city, state and postal code stored separately so they flow straight into a quote.
Sloppy data costs a warning, not a lead
Every field has a sensible size limit. Anything oversized is trimmed and flagged, and the lead still lands. A vendor with a verbose notes field or an odd date format never costs you a customer who was genuinely looking to ship.
You can see which vendor is worth the money
The provider's name travels with the lead through quote and order, so months later you can still tell which vendor produced revenue and which produced noise. It is the same discipline that makes broker fee by lead source a report rather than a guess.
Volume limits that protect you
Each key accepts up to 500 leads a day and 120 requests a minute. The limits are per key, so one provider can never consume another's allowance, and a misconfigured vendor cannot flood your pipeline overnight.
Staying in control
Everything is per key, in your own settings, with no call to support. If a vendor starts sending rubbish at two in the morning, you pause them in one click and sort it out in business hours.
| Action | What it does |
|---|---|
| Pause | Stops that provider immediately. History is kept, and it is reversible at any time. |
| Rotate | Issues a new secret for the same provider, for a leaked or routinely rotated key. |
| Delete | Removes the key permanently. |
Keys can only create leads, and only on the account they were issued for. They cannot read anything back — which is the same company-scoped rule the rest of the platform follows, set out on the security page.
For your provider's developer
The API contract
This section is the technical contract, deliberately close to what the industry already sends. Send your provider this page — their developer needs nothing else.
Endpoint
POST https://app.truxcrm.com/api/leads/inbound
Content-Type: application/json
Authorization: Bearer <your key>X-Api-Key: <your key> is accepted as an alternative header. One lead per request, not an array, with the body under 16 KB.
Example request
curl -X POST https://app.truxcrm.com/api/leads/inbound \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"external_id": "YOUR-LEAD-ID-123",
"full_name": "John Smith",
"email": "john@example.com",
"phone": "555-010-2030",
"origin_city": "Dallas", "origin_state": "Texas", "origin_zip": "75201",
"destination_city": "Miami", "destination_state": "Florida", "destination_zip": "33101",
"vehicle_year": "2019", "vehicle_make": "Honda", "vehicle_model": "Civic",
"vehicle_type": "Sedan",
"transport_type": "Open",
"ship_date": "2026-11-15",
"notes": "Runs and drives"
}'Fields
Required. full_name, or first_name and last_name; and at least one of email or phone.
Strongly recommended. external_id — your own lead ID. It is what makes a retry incapable of creating a duplicate. Send it.
Optional. Route: origin_city, origin_state, origin_zip, destination_city, destination_state, destination_zip. Vehicle: vehicle_year, vehicle_make, vehicle_model, vehicle_type. Also transport_type (Open or Enclosed; anything unrecognised is stored as Open and flagged in warnings), ship_date (YYYY-MM-DD or MM/DD/YYYY) and notes.
Aliases also accepted. name, customer_name, contact_name · email_address · phone_number, mobile, primary_phone · pickup_city/state/zip, from_city/state/zip · dropoff_*, delivery_*, dest_*, to_* · year, make, model · shipping_type, trailer_type, service_type · shipping_date, pickup_date, available_date · comments, message, additional_info · lead_id, provider_lead_id, reference_id. Unknown fields are ignored, so extra data in a payload is harmless.
Field limits
Values above these are trimmed and reported in warnings. The lead is still accepted.
| Field | Max |
|---|---|
full_name | 120 |
email | 160 |
phone | 40 |
origin, destination | 120 |
vehicle_make, vehicle_model | 40 |
vehicle_year | 10 |
notes | 1000 |
external_id | 120 |
| Whole body | 16 KB |
Responses
| Code | Meaning | Retry? |
|---|---|---|
| 201 | Lead created. The body contains lead_id. | — |
| 200 | Duplicate: same external_id, or same person within 24 hours. Merged. | No |
| 400 | Invalid payload. The body lists what to fix. | Not unchanged |
| 401 | Missing or bad key. | No |
| 403 | Key paused, or lead capture is off for this account. | No |
| 413 | Body over 16 KB. | Not unchanged |
| 429 | Rate limited, or the daily cap is reached. See Retry-After. | Yes, later |
| 503 | Temporary problem on our side. | Yes, later |
A successful response looks like this:
{
"success": true,
"status": "created",
"lead_id": 48213,
"order_id": "NV00241",
"accepted_today": 137,
"daily_cap": 500,
"warnings": []
}accepted_today and daily_cap let a provider pace itself without guessing.
Rate limits
500 accepted leads per day per key, returning 429 until midnight beyond that, and 120 requests per minute per key. Every response carries standard RateLimit-* headers.
Questions brokers ask
Do I need a developer to connect a lead provider?
No. You create a key in Settings and send the provider the integration guide beside it. The work is on the provider's side, and for their developer it is an afternoon at most.
What if I buy leads from several providers?
Give each one its own key. That is how you compare them, because the provider's name travels with every lead through quote and order — and it is how you pause one vendor without touching the rest.
Can a provider see my other leads, or another company's?
No. A key can only create leads, and only on the account it was issued for. It cannot read anything back.
What happens if someone gets hold of an API key?
Rotate it in the panel and the old secret stops working immediately. Keys are stored as fingerprints rather than as text, so a copy of the database would not reveal them.
Will bought leads bury me in notifications?
No. Provider leads are silent by design and queue in the Leads tab, because a two hundred lead burst that buzzed your phone would have you turning notifications off altogether. Leads from your own website still notify you as usual.
What happens when a provider hits 500 leads in a day?
The provider receives a clear "try later" response with a retry time, and resumes at midnight. Nothing is lost on your side. Talk to us if you need a higher ceiling.
Does the lead provider API cost extra?
No. It is part of the one TruxCRM plan, with no per-lead fee and no charge per key. The pricing page has the full plan.
Already a customer? Settings → Lead Capture → Create an API key. Not yet? Book a free demo Ask a question
Buying leads is one half of the pipeline. The other is earning them: see lead capture forms for your website. Holding a list already, or moving from another CRM? Import it from CSV. Once a lead books, TruxCRM is an official Central Dispatch partner, so the load is posted to Central Dispatch from the same order; see the rest of the platform on the features page.