Kontor spricht mit deinen Formularen, Postfächern und Werbekonten.

BODY='{"source":"website","company":"Metallbau Krüger GmbH","first_name":"Jana","email":"jana@metallbau-krueger.example","consent":1,"consent_text":"Kontaktformular, Haken gesetzt","note":"Bitte Rückruf"}'
TS=$(date +%s)
SIG=$(printf '%s.%s' "$TS" "$BODY" | openssl dgst -sha256 -hmac "$INTAKE_SECRET" | sed 's/^.* //')

curl -X POST https://crm.deine-firma.example/api/lead-intake.php \
  -H "Content-Type: application/json" \
  -H "X-Elevatem-Timestamp: $TS" \
  -H "X-Elevatem-Signature: $SIG" \
  --data "$BODY"

# → 201 {"ok":true,"status":"created","id":4711}
# → 200 {"ok":true,"status":"duplicate","id":4711}   (Kontakt existiert, leere Felder ergänzt)

// Prüfung auf der Seite von Kontor (api/lead-intake.php, gekürzt)
$body     = file_get_contents('php://input') ?: '';
$zeit     = (string) ($_SERVER['HTTP_X_ELEVATEM_TIMESTAMP'] ?? '');
$signatur = (string) ($_SERVER['HTTP_X_ELEVATEM_SIGNATURE'] ?? '');

// Alte Anfragen ablehnen: höchstens 5 Minuten Abweichung
if (!ctype_digit($zeit) || abs(time() - (int) $zeit) > 300) {
    antwort(401, ['ok' => false, 'error' => 'stale_timestamp']);
}

$erwartet = hash_hmac('sha256', $zeit . '.' . $body, $geheimnis);
if (!hash_equals($erwartet, $signatur)) {
    antwort(401, ['ok' => false, 'error' => 'bad_signature']);
}