Notify new Zivvy CRM leads in Slack with HMAC signature verification

Description

Quick overview
This workflow receives Zivvy CRM lead creation webhooks, verifies the HMAC signature, fetches lead details from the Zivvy API, and posts a formatted notification to Slack via an incoming webhook.

How it works
Receives a POST webhook from Zivvy at /zivvy/crm-leads and captures the raw request body.
Verifies the X-Zivvy-Signature HMAC (sha256) using the raw body and your ZIVVY_WEBHOOK_SECRET.
Stops with an error if the signature is invalid.
Checks that the event is leads.created and ignores any other events.
Fetches the full lead record from the Zivvy API (GET /v1/leads/:id) using the lead identifier from the webhook payload.
Formats key lead fields into a Slack-friendly message.
Sends the message to Slack using your Slack Incoming Webhook URL.

Setup
Create an n8n variable named ZIVVY_WEBHOOK_SECRET with your Zivvy webhook signing secret.
Add an HTTP Header Auth credential for Zivvy API access (header Authorization: Bearer zk_live_...) and select it for the Zivvy API request.
Create an n8n variable named SLACK_WEBHOOK_URL pointing to your Slack Incoming Webhook URL.
Copy the workflow’s Production webhook URL and configure it in Zivvy as a webhook subscribed to leads.created (or leads.*).

Requirements
Zivvy Account