Send email from Leadpages without exposing an email API key by routing each form submission through a secure webhook relay. Leadpages does not offer a native Volanea app or marketplace plugin, but its webhook capability gives you a dependable way to trigger transactional email when a visitor submits a Leadpages form.

This guide shows the direct architecture: Leadpages sends a JSON webhook when a form is submitted, your endpoint validates and normalizes that lead data, and the endpoint calls Volanea's POST /v1/send API. It is a better fit than putting email logic in browser code because the relay can keep credentials private, reject malformed requests, prevent duplicate messages, and create useful logs when something goes wrong.

What triggers the email in Leadpages?

The trigger is Form submitted. In Leadpages, a visitor completes and submits a form on a landing page, site, pop-up, or other lead-collection asset. Leadpages stores the submission and can route the event to an external HTTPS webhook URL in real time.

That distinction matters. The trigger is not a page view, a button click, or a generic contact update. It is the successful submission of the specific form you configure. That gives the integration a clear business event: a person supplied information and completed the form action you presented to them.

For a typical lead-magnet flow, the sequence looks like this:

  1. A visitor lands on a Leadpages page.
  2. They enter their email address and, optionally, their name, company, or campaign preferences.
  3. They submit the Leadpages form.
  4. Leadpages sends a JSON POST request to your webhook endpoint.
  5. Your endpoint validates the request and extracts the recipient email and personalization fields.
  6. Your endpoint sends one transactional message through Volanea.
  7. Volanea accepts the message into its sending pipeline and records the result in its email activity data.

This pattern works for more than welcome emails. You can use the same form-submitted trigger for a download delivery email, webinar registration confirmation, sales inquiry acknowledgement, event reminder, waitlist confirmation, or internal alert to a sales team.

Why not call Volanea directly from the Leadpages page?

A published Leadpages page runs in the visitor's browser. Any Volanea secret key embedded in browser JavaScript, an HTML block, a query string, or a visible form configuration can be extracted by visitors, browser extensions, crawlers, or anyone inspecting network traffic. A secret key is a sending credential, not a public identifier.

The safe architecture is therefore:

Leadpages form submission
        |
        v
HTTPS webhook to your server or serverless function
        |
        v
Volanea POST /v1/send

The webhook relay is small, but it establishes an important security boundary. Leadpages knows only your endpoint URL and the Leadpages webhook secret you choose. Volanea's API key stays in server-side secret storage and is never delivered to the browser or saved in a client-visible Leadpages asset.

What Leadpages webhook data should you expect?

Leadpages documents webhooks as JSON POST deliveries for selected events. For a form-submitted webhook, the payload includes the form data you choose to send and can include page metadata and UTM information. Because the configured form fields vary by page and Leadpages lets you choose fields and metadata for a webhook, there is not one universal fixed set of lead-field names that every account receives.

In practical terms, the payload shape is driven by your form design. A simple form may supply an email field only. A more complete form can supply first name, last name, company, phone, custom responses, page information, and attribution parameters.

Before publishing the automation, decide on a field contract. For example:

Leadpages form fieldRelay fieldVolanea use
emailemailRecipient address
first_namefirstNameGreeting personalization
last_namelastNameOptional personalization
companycompanyInternal notification context
messagemessageSales inquiry context
UTM fields or page metadatasourceAttribution and message logic

A representative form-submission body for that field contract looks like this:

{
  "email": "ada@example.com",
  "first_name": "Ada",
  "last_name": "Lovelace",
  "company": "Analytical Engines Ltd.",
  "message": "Please send the implementation guide.",
  "utm_source": "linkedin",
  "utm_campaign": "developer-guide",
  "page_url": "https://www.example.com/implementation-guide"
}

Treat this as a field-level contract, not an excuse to assume every Leadpages form uses these labels. If your actual form uses Email Address, First Name, or a custom question label, update the mapping in the relay accordingly. Submit the real published form once to a request inspector or staging endpoint, save the raw JSON delivery, and make that captured body your source of truth.

That final validation step is especially important when marketing changes a field label, duplicates a page, creates a new form, or adds a field only to one campaign. An email integration is reliable when it has an intentional contract, not when it silently guesses.

Configure the Leadpages webhook

In the current Leadpages workflow, webhook destinations are configured under the account's webhook settings. Create a webhook, add your HTTPS endpoint, choose the Form submitted event, then select the Leadpages pages to which the webhook applies. Leadpages also provides a Secret Key option for the webhook configuration.

Use a dedicated production endpoint, such as:

https://automations.example.com/webhooks/leadpages

Do not point production Leadpages traffic at a personal development tunnel, a temporary request-bin URL, or a route that has no authentication. Those are useful for short-lived inspection, but they are not an appropriate permanent destination for lead data.

Recommended Leadpages configuration

Set up the webhook with these decisions in mind:

  • Event: Select Form submitted only. Do not subscribe to page-published or page-updated events for an email-send flow.
  • Scope: Apply the webhook only to the pages or forms intended to trigger the email. Start with one page when testing.
  • Destination URL: Use an HTTPS URL owned by your application, serverless platform, or integration service.
  • Secret Key: Set a long random value and store the matching value in your relay's secret manager.
  • Fields: Include the form fields that your email needs, plus only the metadata you use for routing or attribution.
  • Testing: Submit the published form with a controlled inbox before enabling paid traffic.

A webhook secret and a Volanea API key solve different problems. The Leadpages webhook secret lets your relay authenticate incoming requests from the form system. The Volanea secret key authenticates the outbound request that sends mail. Keep them separate, rotate them independently, and never reuse one as the other.

Where the Volanea key belongs

The Volanea key belongs in the secret store or environment configuration of the middleware service. For a Node deployment, that usually means an environment variable such as:

VOLANEA_API_KEY=sk_live_replace_with_your_secret

It does not belong in:

  • A Leadpages page's Custom HTML or JavaScript.
  • A hidden form field.
  • A Leadpages webhook URL query parameter.
  • A browser-side environment variable with a public prefix.
  • A Git repository, screenshot, support ticket, or shared spreadsheet.

Use a separate LEADPAGES_WEBHOOK_SECRET environment variable for the shared incoming-webhook secret. The relay reads both values at runtime. Leadpages receives neither the Volanea key nor an API URL that embeds it.

For more detail on request authentication, endpoint fields, and available sending options, use the Volanea API reference as the implementation authority rather than copying an old code snippet from another integration.

Build the secure Leadpages-to-Volanea relay

The following example is a complete Node.js relay using Express. It accepts the JSON body from Leadpages, checks a shared secret in the request header, maps common form-field names, creates a stable idempotency key, and sends a personalized confirmation through Volanea.

This example uses a simple header named x-leadpages-webhook-secret for the shared-secret check. Confirm the exact credential-delivery mechanism your Leadpages webhook configuration provides in your account and adapt the isAuthorized function if necessary. The key design principle does not change: authenticate the inbound request at your server, and never put the Volanea key in the Leadpages page.

import crypto from "node:crypto";
import express from "express";

const app = express();
app.use(express.json({ limit: "256kb" }));

const {
  LEADPAGES_WEBHOOK_SECRET,
  VOLANEA_API_KEY,
  VOLANEA_FROM_EMAIL,
  VOLANEA_FROM_NAME = "Example Company",
  VOLANEA_REPLY_TO
} = process.env;

function readString(value) {
  return typeof value === "string" ? value.trim() : "";
}

function firstPresent(payload, names) {
  for (const name of names) {
    const value = readString(payload[name]);
    if (value) return value;
  }
  return "";
}

function escapeHtml(value) {
  return String(value)
    .replaceAll("&", "&")
    .replaceAll("<", "&lt;")
    .replaceAll(">", "&gt;")
    .replaceAll('"', "&quot;")
    .replaceAll("'", "&#039;");
}

function makeIdempotencyKey(payload) {
  // Prefer Leadpages' delivery/submission identifier if your captured payload includes one.
  // Otherwise derive a repeatable key from stable form values for this example.
  const stableValue = JSON.stringify({
    email: firstPresent(payload, ["email", "Email", "Email Address"]),
    page: firstPresent(payload, ["page_url", "pageUrl", "Page URL"]),
    submittedAt: firstPresent(payload, ["submitted_at", "submittedAt", "timestamp"])
  });

  return crypto
    .createHash("sha256")
    .update(stableValue)
    .digest("hex");
}

function isAuthorized(req) {
  const supplied = readString(req.get("x-leadpages-webhook-secret"));
  if (!LEADPAGES_WEBHOOK_SECRET || !supplied) return false;

  const expected = Buffer.from(LEADPAGES_WEBHOOK_SECRET);
  const actual = Buffer.from(supplied);
  return expected.length === actual.length && crypto.timingSafeEqual(expected, actual);
}

app.post("/webhooks/leadpages", async (req, res) => {
  if (!isAuthorized(req)) {
    return res.status(401).json({ error: "Unauthorized webhook" });
  }

  const payload = req.body ?? {};

  // Map the real labels configured in your Leadpages form.
  const email = firstPresent(payload, ["email", "Email", "Email Address"]);
  const firstName = firstPresent(payload, ["first_name", "firstName", "First Name"]);
  const company = firstPresent(payload, ["company", "Company"]);
  const source = firstPresent(payload, ["utm_source", "UTM Source"]);
  const campaign = firstPresent(payload, ["utm_campaign", "UTM Campaign"]);

  if (!email || !email.includes("@")) {
    return res.status(422).json({
      error: "A valid email field is required",
      receivedFields: Object.keys(payload)
    });
  }

  const greetingName = firstName ? ` ${escapeHtml(firstName)}` : "";
  const context = [source, campaign].filter(Boolean).join(" / ");

  const volaneaPayload = {
    fromEmail: VOLANEA_FROM_EMAIL,
    fromName: VOLANEA_FROM_NAME,
    replyTo: VOLANEA_REPLY_TO || undefined,
    to: email,
    subject: "Your guide is on its way",
    html: `
      <p>Hi${greetingName},</p>
      <p>Thanks for requesting the guide${company ? ` from ${escapeHtml(company)}` : ""}.</p>
      <p><a href="https://www.example.com/downloads/guide">Download your guide</a></p>
      ${context ? `<p style="color:#666;font-size:12px">Source: ${escapeHtml(context)}</p>` : ""}
    `,
    text: `Hi${firstName ? ` ${firstName}` : ""},\n\nThanks for requesting the guide. Download it here: https://www.example.com/downloads/guide`
  };

  const response = await fetch("https://api.volanea.com/v1/send", {
    method: "POST",
    headers: {
      "Authorization": `Bearer ${VOLANEA_API_KEY}`,
      "Content-Type": "application/json",
      "Idempotency-Key": makeIdempotencyKey(payload)
    },
    body: JSON.stringify(volaneaPayload)
  });

  const responseBody = await response.text();

  if (!response.ok) {
    console.error("Volanea send failed", {
      status: response.status,
      responseBody,
      recipient: email
    });

    // Return a 5xx for a temporary provider failure so the sender can retry.
    // Return a 4xx for a permanent mapping or validation problem.
    return res.status(response.status >= 500 ? 502 : 422).json({
      error: "Volanea did not accept the email",
      status: response.status
    });
  }

  console.info("Leadpages confirmation accepted", {
    recipient: email,
    idempotencyKey: makeIdempotencyKey(payload)
  });

  return res.status(200).json({ ok: true });
});

app.listen(process.env.PORT || 3000);

Field mapping in the code

The important mapping happens before the Volanea call. The relay converts the lead data into an email request:

Leadpages email field       -> Volanea `to`
Leadpages first-name field  -> HTML greeting and plain-text greeting
Leadpages company field     -> Optional copy in the email
Leadpages UTM fields        -> Optional attribution context
Server environment          -> `fromEmail`, `fromName`, `replyTo`, API key

This keeps the marketing form flexible while preserving a controlled sending contract. A marketer can change the headline or button copy without touching the email infrastructure. But if they rename an email field, add a second form, or change the confirmation experience, the integration owner has a small, visible location to update and test the mapping.

The code uses fromEmail, fromName, replyTo, to, subject, html, and text in the Volanea request. Use a sending address on a domain you have verified in Volanea. A successful API acceptance means Volanea accepted the request for processing; it should not be treated as proof that a recipient has already received the message.

Choose the right email type for the form

A Leadpages form does not automatically make every follow-up email transactional. The purpose and consent model determine how you should structure the send.

A visitor who requests a promised guide, submits a contact inquiry, registers for a webinar, or asks for a receipt generally expects an immediate operational response. A message that supplies that requested item or confirms the submission is naturally tied to the form action.

A visitor who submits a general lead form has not necessarily consented to a long-term promotional sequence merely because they supplied an address. If you intend to add them to ongoing marketing, make the opt-in language clear on the form, record the relevant consent context, and use your marketing workflow and unsubscribe handling accordingly.

A useful two-message pattern

Many teams get better results by separating the immediate response from nurture:

  1. Transactional confirmation: Send the promised asset or confirmation immediately after the form is submitted.
  2. Permission-aware follow-up: Add the contact to an appropriate campaign only when the form copy and consent model support it.

This approach makes the first email useful even when a contact never engages with future marketing. It also prevents operational messages from becoming overloaded with promotions, tracking experiments, and unrelated calls to action.

Make the flow reliable with idempotency

Webhooks are delivery attempts over a network. Your endpoint can process the request successfully while the sender never receives the 200 response because of a timeout, connection reset, deployment interruption, or proxy problem. In that case, a retry can arrive even though the first Volanea request already created an email send.

That is why the relay sets the Idempotency-Key header on the Volanea POST /v1/send request. Volanea supports idempotency keys for safe retries. The key lets Volanea recognize that repeated calls represent the same send operation rather than a request to deliver a second identical email.

Pick a stable idempotency key

The best key is a unique Leadpages submission or delivery ID, if your captured webhook payload includes one. Use a value tied to the actual form submission, not an email address alone. The same person can legitimately submit two different forms or submit the same form again months later.

If the payload does not expose a durable submission identifier, derive a hash from stable values that together identify the event, such as:

  • Recipient email address.
  • Form identifier or page URL.
  • Submission timestamp.
  • A campaign or page version marker when needed.

The example code hashes email, page, and submitted timestamp. Replace that fallback with the actual Leadpages submission identifier after you inspect a real delivery. Do not use a random UUID generated anew for every request: retries would get different keys and deduplication would not work.

Reply quickly, process deliberately

A webhook endpoint should avoid doing unrelated slow work before it responds. Calling Volanea directly is often fast enough for a simple confirmation, but a production design should still have a timeout and clear retry policy.

If your email requires multiple database writes, file generation, CRM lookups, or AI content generation, acknowledge the authenticated webhook after you have durably queued it. A worker can then perform the slower work and call Volanea with the same idempotency key. This reduces timeout risk without sacrificing delivery control.

When this breaks: diagnose the Leadpages-to-Volanea hop

The integration has two network boundaries: Leadpages to your webhook endpoint, then your endpoint to Volanea. Debugging gets much easier when you log the result of each boundary separately and avoid treating every failure as an email-provider issue.

Leadpages retries create duplicate emails

What you see: A contact receives two welcome emails, or your logs show the same form data more than once.

Why it happens: Webhook senders can retry after a timeout or a non-success response. Your service may have sent the Volanea request before it failed to return a response to Leadpages.

What to do: Use a deterministic Idempotency-Key derived from the Leadpages submission or delivery ID. Also store processed submission IDs in your own database when the email has expensive side effects beyond sending, such as coupon generation or CRM stage updates. Return a successful response for an authenticated duplicate after confirming it has already been handled.

Your webhook endpoint times out

What you see: Leadpages reports a failed delivery, your logs show a request that ends abruptly, or a duplicate arrives shortly afterward.

Why it happens: Cold starts, synchronous database work, slow template rendering, a down dependency, or a long Volanea request can cause your endpoint to exceed the webhook sender's patience.

What to do: Keep the webhook route minimal. Validate, create the idempotency key, enqueue the event or call Volanea, and respond. Set an outbound timeout. If the Volanea request returns a temporary failure, return a retryable server error only when your idempotency design is in place.

A payload field is missing or has a different label

What you see: The relay returns 422, the recipient field is empty, or personalization is blank.

Why it happens: Leadpages forms are configurable. A page may use Email Address while another uses email; a cloned page may omit a name field; hidden fields or UTM metadata may not be configured consistently. Depending on account configuration and what you choose to include, payload fields may differ between pages.

What to do: Log the top-level field names, not full personal data, on validation failure. Capture a safe staging submission for each form. Make the recipient field required in Leadpages. Keep the mapper explicit, and use defensive defaults for optional fields such as first name and company.

The Volanea request is rejected

What you see: Your relay receives a non-2xx response from POST /v1/send.

Likely causes: The API key is missing or invalid, the sending domain is not verified, the fromEmail value is not permitted, a required field is malformed, or the receiving address cannot be sent to because of suppression or policy handling.

What to do: Log Volanea's HTTP status and response safely, without logging the API key. Confirm the server has the expected environment variables, verify the from domain, and test with a Volanea test key before switching to a live key. Review the send record and event data in Volanea rather than assuming the landing-page submit succeeded end to end.

The page was published, but no email arrives

What you see: The visitor sees the thank-you state, but no message appears in their inbox.

What to do: Work backward through the chain:

  1. Confirm the form submission appears in Leadpages submissions.
  2. Confirm Leadpages attempted the webhook delivery.
  3. Confirm your relay recorded the inbound request.
  4. Confirm the relay made the Volanea call and received a successful response.
  5. Check Volanea's send record and event outcome.
  6. Check the recipient's spam or promotions folder only after the prior steps are confirmed.

This sequence prevents a common mistake: debugging inbox placement when the request never reached the mail provider in the first place.

Test before you connect paid traffic

Do not test this integration for the first time with a live advertising campaign. Build a small test plan that verifies the exact form, exact page, exact sender domain, and exact recipient experience.

Minimum acceptance checklist

  • Submit the published Leadpages form with a test inbox you control.
  • Confirm the expected JSON fields reach the webhook route.
  • Confirm a missing email address returns a controlled validation error.
  • Submit the same event twice or replay a captured test request to confirm idempotency.
  • Confirm the Volanea message shows the expected from name, from address, reply-to address, subject, HTML, and text fallback.
  • Open the email on desktop and mobile.
  • Verify the download link, event link, or next-step CTA.
  • Test a form with no first-name value to ensure the greeting remains natural.
  • Rotate the webhook secret and Volanea key in a non-production environment to confirm the team knows the recovery procedure.

A Volanea test key is useful during development because it lets you exercise request validation and logging without treating every code test as a real customer send. After the mapping is confirmed and your domain is ready, switch the deployment's server-side environment variable to the live key.

Direct webhook relay vs. Make or Zapier

A direct webhook relay is the recommended route when you need ownership of credentials, deterministic retries, custom validation, and an audit trail. It also makes it easier to change message behavior based on a page URL, hidden campaign field, UTM source, or CRM response.

An automation platform can be a practical alternative when the flow is simple and your team does not maintain application infrastructure. Leadpages can send webhook data to automation tools such as Make, and the automation can make the Volanea HTTP request using a securely stored connection credential.

Use a direct relay when you need:

  • Code-level validation and custom payload normalization.
  • A reliable idempotency strategy tied to submission IDs.
  • Conditional templates, database lookups, or internal entitlement logic.
  • Detailed logs and alerting owned by your engineering team.
  • Strict control over where lead data is processed.

Use an automation platform when you need:

  • A fast no-code proof of concept.
  • A simple one-form, one-email workflow.
  • Visual mapping that a non-engineering operator must maintain.
  • Additional low-risk steps such as creating a spreadsheet row or Slack notification.

The security rule remains the same in either model: store the Volanea key in the server-side environment or the automation platform's encrypted credential store, never in Leadpages page code or form fields.

Operational practices that keep the integration healthy

A form-to-email flow is easy to launch and easy to forget. Add lightweight operational ownership so a page redesign does not quietly stop confirmations from sending.

First, create a dashboard or log query for webhook requests, validation failures, Volanea acceptance failures, and duplicate events. Track counts by page URL or form identifier. A sudden rise in validation errors usually signals a form-field change rather than an email infrastructure outage.

Second, alert on repeated outbound failures. A revoked key, unverified sending domain, or expired deployment secret should produce an actionable alert before a campaign accumulates hours of unacknowledged leads.

Third, version your email content separately from the landing page. The Leadpages form tells the relay that a conversion occurred; the relay decides which confirmed, reviewed email content to send. That separation makes it safer to test copy changes and roll them back.

Finally, validate addresses at the right point in your funnel. Browser validation and Leadpages required fields are useful, but they do not guarantee a mailbox can receive mail. For workflows where address quality materially affects cost, sales follow-up, or sender reputation, check addresses before adding them to long-term outreach. Volanea's email verification tool can help with one-off checks during troubleshooting or list hygiene work.

Conclusion

To send email from Leadpages with Volanea, use the Leadpages Form submitted webhook as the event source and a server-side relay as the security and reliability layer. The relay receives the selected JSON form data, maps recipient and personalization fields, protects the Volanea API key, and sends through POST /v1/send with an idempotency key.

There is no native Leadpages marketplace installation required—and no safe reason to place a sending secret in a published landing page. The webhook pattern is more flexible: it lets you use different pages, forms, UTM values, and message logic while maintaining one controlled sending integration.

Start with one form, capture a real test payload, explicitly map the fields you intend to support, and verify duplicate handling before scaling traffic. That small amount of engineering turns an otherwise fragile form follow-up into dependable email infrastructure.

FAQ

Does Leadpages have a native Volanea integration?

No. Leadpages does not provide a native Volanea app, listing, or marketplace plugin. Use a Leadpages webhook that sends form-submission data to your server, serverless function, or automation workflow, then call Volanea from that secure middle layer.

What Leadpages event should trigger the email?

Use the Form submitted webhook event. It fires when a visitor submits a configured Leadpages form and is the appropriate event for confirmation emails, lead-magnet delivery, registrations, and inquiry acknowledgements.

Where should I store the Volanea API key?

Store it only in server-side environment variables, a cloud secret manager, or an automation platform's encrypted credential store. Never place it in Leadpages page JavaScript, a form field, a public configuration object, or a webhook URL.

How do I prevent duplicate emails when Leadpages retries a webhook?

Pass a stable Idempotency-Key header with the Volanea send request. Base it on the Leadpages submission or delivery ID when available. If necessary, derive it from a stable combination of the submission timestamp, recipient, and form or page identifier.

Can I use Make or Zapier instead of writing a webhook relay?

Yes, for simple workflows. Configure Leadpages to deliver the form submission to the automation platform, store the Volanea API key in that platform's credential store, and use its HTTP module to call Volanea. Use a direct relay when you need stronger validation, custom logic, detailed logs, or precise idempotency control.