Lead capture + HubSpot sync

A lead capture form that writes straight into HubSpot

Most website lead capture is three products stitched together: a form builder, an automation tool, and your CRM. Each one bills you monthly, each one is a place the chain can break, and none of them is yours.

This replaces all three with one app you own outright. A public capture form, a single server round-trip that validates the lead, saves it to your own database, and creates the HubSpot contact, and a private admin inbox that shows you exactly what synced and what did not. One purchase, $149, no subscription, no per-lead fee.

How a submission actually flows

One request, three things, in order:

1. Validated. Name, email, company, message, and an optional source field for attribution, all checked with zod before anything touches your data. Emails are trimmed and lowercased so Sam@Acme.com and sam@acme.com are the same person.
2. Matched or created in HubSpot. Contacts API v3. If that email already exists in your CRM, the app finds the existing contact and records its id rather than failing or creating a duplicate.
3. Saved to your own Postgres, stamped with the HubSpot contact id, behind row-level security that lets anonymous visitors write but only signed-in admins read.

No webhook queue to babysit, no third party holding your leads.

Why not a form builder plus Zapier

The stitched-together version works. It also has properties you may not have priced in:

The honest case for staying on SaaS: you never patch it, never deploy it, and someone else is on call. If that is worth a recurring bill to you, stay. This is for people who would rather own the thing.

Built so a lead is never lost

Failure handling is the part that separates a working lead pipeline from a leaky one.

• If HubSpot is down or your token is wrong, the lead still saves to your database and the error text is written onto that row. Nothing is dropped on the floor. The admin list shows a failed badge so you can see it immediately and re-sync by hand.
• If you have no HubSpot account yet, the app runs anyway. Leads save locally with a "Local only" badge until you paste a token.
• Duplicate emails do not error. The existing contact is matched and linked.

Being precise about one thing: re-syncing a failed lead is a manual step, not an automatic background retry. The failure is recorded and visible rather than silently swallowed, which is the part most DIY builds get wrong.

What it costs to run

• Hosting: free on Vercel's hobby tier for typical volumes
• Database and auth: Supabase free tier is enough to start
• HubSpot: a private app token with two scopes, crm.objects.contacts.write and crm.objects.contacts.read. No OAuth app, no partner review.
• Per lead: nothing

An inbox, not a spreadsheet

Admin lives at /admin behind magic-link sign-in. Recent submissions, each with a per-lead sync badge, so a broken HubSpot token is obvious at a glance rather than discovered a week later when someone asks where the leads went. Demo seed data is included so the app looks alive the first time you run it.

What it does not do

Stated plainly, so nothing surprises you after purchase:

• No spam protection out of the box. Honeypot and IP rate limiting are two of the included AI prompts, not shipped features.
• No automatic background retry of failed syncs, as described above.
• No multi-step or conditional form logic. This is one clean form, not a form builder.
• HubSpot only. Salesforce or Pipedrive would be a code change, and the AI prompts make that a realistic afternoon.

Built for AI editing

Ships agent-ready with AGENTS.md, which Claude Code, Cursor, and Windsurf load automatically, plus CUSTOMIZE_WITH_AI.md containing ten ready-to-paste prompts: add a phone field, Slack alerts on new leads, honeypot anti-bot, IP rate limiting, CSV export, auto-reply emails via Resend, an embeddable widget version, or swapping magic-link auth for email and password.

That is the point of buying source instead of renting a form. The changes you would file as a feature request are changes you can just make.

What is in the box

• Stack: Next.js 15 App Router, React 19, strict TypeScript, Tailwind v4, Supabase Postgres and auth, HubSpot Contacts API v3
• Docs: step-by-step setup, Vercel deploy guide, troubleshooting, and copy-paste customization recipes
• Setup: create a Supabase project, run one migration, paste your HubSpot token. About 30 minutes.
• Licence: single-use commercial. One purchase covers one commercial project, including one you build and deliver for a client, source code included.

Questions people ask before buying

Do I need a paid HubSpot plan? You need a HubSpot account where you can create a private app and grant it the two contacts scopes. There is no OAuth application to register and no partner review to pass.

What if I do not use HubSpot at all? It works without it. Leads save to your own database and show a "Local only" badge. You can add a token later, or point it at another CRM as a code change.

Will it create duplicate contacts in my CRM? No. Submissions are matched to an existing contact by email, and the app records that contact's id rather than creating a second record.

What happens to a lead if HubSpot is unreachable? It is saved to your database with the sync error recorded on the row, and flagged in the admin inbox. You re-sync it yourself once the cause is fixed. Nothing is lost.

Do I need to be a developer? You need to be comfortable creating a Supabase project, pasting environment variables, and clicking deploy on Vercel. The setup guide covers each step. Customization is designed to be done by asking an AI coding tool rather than by writing code.

Can I use this for a client project? Yes. One purchase covers one commercial project, whether it is yours or one you build and hand to a client, and you may transfer the finished app to that client with its source code. A second client is a second project and needs a second licence.

Is there spam protection? Not shipped. Honeypot and rate limiting are included as AI prompts you apply in minutes, which is the honest answer rather than implying they are already there.

Why is my magic-link email not arriving? Supabase's default SMTP on the free tier is rate-limited to roughly three emails an hour. For real use, configure your own SMTP in Supabase. The troubleshooting doc covers it.