Lead Hub API

POST /api/leads

Accepts a lead, verifies contact info via XVerify, saves to Supabase, and syncs to AWeber. Beehiiv sync is currently disabled — set BEEHIIV_ENABLED=true to resume.

POST /api/members

Enrolls an authenticated reader of the weekly-investor site as a member. Same pipeline as /api/leads (auth → validate → dedupe → XVerify → save) with these differences:

• Body = lead payload plus user_id (required Supabase auth uuid) and optional displayName.
• Saves to members instead of leads. tier is always free — never accepted from callers.
• Subscriber syncs to the dedicated AWeber members list (AWEBER_MEMBERS_LIST_ID), tagged member_signup + weekly_investor_newsletter with ad_tracking: theweeklyinvestor_members.
• Dedupe — same user_id or email returns 409 permanently (no 5-minute window).

Trust model: user_id must be a real auth.users row (FK enforced). Email in the body must match that auth user's email — the weekly-investor site bridge enforces this via auth.admin.getUserById.

Authentication

All requests must include:

x-api-key: <LEAD_HUB_API_KEY>

Missing or incorrect key returns 401 Unauthorized.

Request Fields

Content-Type: application/json

Shared by both routes unless noted. /api/members does not accept double_opt_override.

Example Request — /api/leads

curl -X POST https://your-domain.com/api/leads \
  -H "Content-Type: application/json" \
  -H "x-api-key: your_api_key_here" \
  -d '{
    "source": "weekly-investor",
    "email": "jane@example.com",
    "phone": "5551234567",
    "firstName": "Jane",
    "lastName": "Doe",
    "marketing_consent": true,
    "sms_consent": false,
    "double_opt_override": "off",
    "aff": "aff123",
    "s1": "click_abc",
    "utm_source": "facebook",
    "utm_medium": "cpc",
    "utm_campaign": "q1-promo"
  }'

Example Request — /api/members

curl -X POST https://your-domain.com/api/members \
  -H "Content-Type: application/json" \
  -H "x-api-key: your_api_key_here" \
  -d '{
    "source": "the-weekly-investor-site",
    "user_id": "550e8400-e29b-41d4-a716-446655440000",
    "email": "jane@example.com",
    "firstName": "Jane",
    "lastName": "Doe",
    "marketing_consent": true
  }'

Responses

{
  "success": true,
  "leadId": "uuid-string",
  "source": "weekly-investor",
  "verified": { "email": true, "phone": true }
}

{
  "success": true,
  "memberId": "550e8400-e29b-41d4-a716-446655440000",
  "source": "the-weekly-investor-site",
  "verified": { "email": true, "phone": false }
}

{ "error": "Validation failed", "details": { ... } }

{ "error": "Unauthorized" }

{ "error": "Already submitted. Check your email for confirmation.", "isDuplicate": true }

{ "error": "Already a member.", "isDuplicate": true }

{ "error": "Verification service unavailable. Please try again." }

{ "error": "Internal server error" }

Cron Jobs

Both require Authorization: Bearer <CRON_SECRET>.

Behavior Notes