Webmasters: token and landing page setup

A webmaster is a partner or traffic source that holds its own token and can create leads in X10 CRM through the public API. Every lead is automatically signed with that webmaster: the source is visible, and reporting and payouts work. This page covers the whole path — from creating the token to a working form on the landing page.

Why this matters at the process level is on the CRM for dropshipping page: where leads come from, how each source's conversion is measured and what exactly you pay a partner for.

#Step 1. Create a webmaster and get the token

1. 01

   Open the “Webmasters” section

   Choose Webmasters in the CRM side menu. It lists every partner, their tokens, the payout amount and whether they are active.

2. 02

   Click “Add webmaster”

   Enter a name (it also becomes the lead source in the card, so make it readable: Instagram Ads, Partner Ivanov, Landing shop-example) and the payout per lead. The amount can be changed later.

3. 03

   Copy the token

   The token is generated automatically — a random 43-character string. The table shows the ready-made API address next to it. Copy it with the button rather than by selecting it with the mouse: a stray trailing space breaks authorisation.

#Step 2. The API address

A lead is created with a single POST request. The token goes straight into the path — no separate authorisation headers are needed.

• crm.your-domain.com — replace it with your CRM address (the same one you sign in to).
• {TOKEN} — the webmaster token from the previous step.
• The trailing slash is required.
• The method is POST only. GET returns 405.

#Step 3. The first test request

Before touching the landing page, make sure the token works. Run the request from a terminal — the lead should appear in the CRM within seconds.

curl -X POST "https://crm.your-domain.com/api/webmasters/YOUR_TOKEN/leads/create/" \
  -H "Content-Type: application/json" \
  -d '{"phone": "380681234567", "fullname": "Test from the documentation"}'

A successful response looks like this — lead_id is the number of the created lead:

{"ok": true, "lead_id": 10241}

#Request format

#Lead fields

Only one field is required — phone. The rest are optional, but the more you send, the less the operator has to fill in by hand.

#What the CRM fills in itself

#Step 4. Connect the landing page

There are three workable ways. The first is the most reliable: the token stays on the server and you can see the result of every request.

<?php
// send-lead.php — the landing form posts here, and this file posts to the CRM.
// The token stays on the server and never reaches the page source.

$token = getenv('X10_WM_TOKEN');
$url   = "https://crm.your-domain.com/api/webmasters/{$token}/leads/create/";

$payload = [
    'phone'        => $_POST['phone']    ?? '',
    'fullname'     => $_POST['name']     ?? '',
    'comment'      => $_POST['comment']  ?? '',
    'landing'      => $_SERVER['HTTP_HOST'] ?? '',
    'city'         => $_POST['city']     ?? '',
    'np_department'=> $_POST['np']       ?? '',
    'utm_source'   => $_POST['utm_source']   ?? '',
    'utm_medium'   => $_POST['utm_medium']   ?? '',
    'utm_campaign' => $_POST['utm_campaign'] ?? '',
];

$ch = curl_init($url);
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => json_encode($payload, JSON_UNESCAPED_UNICODE),
    CURLOPT_HTTPHEADER     => ['Content-Type: application/json'],
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT        => 10,
]);

$response = curl_exec($ch);
$status   = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if ($status === 200) {
    header('Location: /thank-you');
    exit;
}

error_log("X10 CRM: lead was not created. HTTP {$status} {$response}");
header('Location: /?error=1');

#Responses and errors

#Token security

• The token allows creating leads only. It gives no access to the database, calls or settings.
• In the browser version the token is visible in the page source. That is an acceptable risk (the worst case is spam leads), but if the traffic source is doubtful, proxy the request through your own backend.
• A compromised token is replaced in half a minute: Webmasters → edit → Generate new token. The old one stops working instantly — remember to update every landing page.
• To pause a partner temporarily, clear the Active checkbox: the API starts returning 403 immediately and the lead history is preserved.

#If something does not work

#Checklist before you send traffic

• The webmaster is created, the payout is set and the “Active” switch is on
• A test cURL request returned {"ok": true} and the lead is visible in the CRM
• The phone field arrives in international format
• landing is sent — so that sites can be told apart
• UTM tags from the page address are passed through
• If you submit from the browser, the landing domain is in the CRM allowed origins
• The CRM has a status with the new code
• The submit button is disabled while the request is in flight
• After a successful submission the visitor sees a thank-you page