If you've spent any time in the Salesforce ecosystem, you're likely familiar with standard Web-to-Lead functionality. It's a classic feature: you generate an HTML form, paste it onto your website, and leads magically appear in your CRM.
However, as a Salesforce Architect, I constantly have to look ahead. What happens when your company scales? Standard Web-to-Lead has a hard limit of 500 leads per day. Furthermore, exposing an unauthenticated Salesforce endpoint directly to the public internet can invite spam and dirty data. If your website is built on a robust framework like Laravel, you likely want to pre-process, validate, and route data before it ever touches your CRM.
To solve this, our team architected Web Lead Trasol AI — a 2nd-Generation Managed Package (2GP) built specifically to bridge Laravel and Salesforce securely. Here is a step-by-step guide on how we designed it, and how you can set it up in your own org.
"Build a zero-friction, zero-maintenance bridge between any external web property and Salesforce CRM — delivered as a distributable AppExchange managed package so any Salesforce customer can install and use it in minutes, with enterprise-grade OAuth security and no 500/day ceiling."
The Architectural Vision: Why Abandon Standard HTML Forms?
When designing an enterprise-grade integration between an external web server (Laravel) and Salesforce, security and scalability are the top priorities. We wanted a plug-and-play solution that didn't require our customers to write custom Apex REST endpoints or expose themselves to vulnerabilities.
1. External Client Apps (ECA) Over Legacy Connected Apps
Historically, ISVs packaged "Connected Apps" to handle OAuth integrations, which often led to security policy conflicts. We utilize the new External Client App (ECA) framework. ECAs separate the Global OAuth Settings from Local OAuth Policies, giving you a highly secure, isolated OAuth 2.0 endpoint specifically for your Laravel application.
ECAs are the Salesforce-preferred model for new server-to-server integrations in the enhanced Lightning Setup. Unlike Connected Apps, ECAs are fully packagable as managed components — meaning customers receive your OAuth configuration as part of the installed package. No manual OAuth setup required on their side.
2. Unidirectional REST API Data Flow
Instead of Salesforce polling the website, we utilize an event-driven flow. Laravel intercepts the form payload, runs internal validation and deduplication, authenticates via the packaged ECA, and pushes clean data to the Salesforce REST API.
3. Zero-Apex Footprint
The best code is no code. Because the heavy lifting is handled by the Laravel server, our managed package contains only declarative metadata. There is zero custom Apex, ensuring it is inherently safe and performant — and passes Salesforce's Security Review with minimal friction.
Why Not Standard Web-to-Lead?
Before diving into setup, it helps to understand where standard Web-to-Lead falls short for growing organisations:
| Capability | Standard Web-to-Lead | Web Lead Trasol AI |
|---|---|---|
| Lead Creation Limit | 500 leads / 24 hours | ✓ Unlimited (API-driven) |
| Authentication | ✗ None (public endpoint) | ✓ OAuth 2.0 Web Server Flow |
| Server-Side Validation | ✗ Not supported | ✓ Full Laravel middleware |
| Spam Prevention | reCAPTCHA only | ✓ Auth + validation layer |
| Custom Field Mapping | Limited HTML fields | ✓ Any field via JSON payload |
| AppExchange Package | ✗ N/A | ✓ 2GP Managed Package |
Step-by-Step Guide: Setting Up Web Lead Trasol AI
If you are an Admin or Architect looking to deploy this modern API-driven approach, here is exactly how to set it up.
Head over to the Salesforce AppExchange and search for Web Lead Trasol AI. We utilize a "Freemium" model, meaning you can install the basic integration tier entirely for free to test the architecture.
- Click "Get It Now" on the AppExchange listing page.
- Select "Install in Production" or "Install in Sandbox" depending on your environment.
- Grant access to third-party web sites as prompted — this allows the API handshake between your Salesforce org and the Laravel backend.
Once installed, we need to grab the OAuth keys that will allow your Laravel server to securely knock on Salesforce's door.
- In your Salesforce org, navigate to Setup > External Client App Manager.
- Locate the Web Lead Trasol AI app in the list.
- Click the dropdown arrow and select View.
- Expand the OAuth Settings section and click the "Consumer Key and Secret" button.
- Copy the Consumer Key (Client ID) and Consumer Secret.
Never share your Consumer Secret in a public repository, HTML page, or JavaScript file. It must live exclusively in your server's environment variables. Anyone with both your Consumer Key and Secret can authenticate to Salesforce as your integration user.
Hand those credentials over to your backend web developer. They will simply paste them into the Laravel environment variables (.env file). This prevents hardcoding sensitive passwords into your source code.
# Salesforce OAuth Credentials — Web Lead Trasol AI SALESFORCE_CLIENT_ID=your_consumer_key_here SALESFORCE_CLIENT_SECRET=your_consumer_secret_here SALESFORCE_LOGIN_URL=https://login.salesforce.com SALESFORCE_USERNAME=your_integration_user@yourorg.com SALESFORCE_PASSWORD=your_password_plus_security_token
With the credentials in place, your Laravel backend is now securely authenticated with Salesforce. When a visitor submits a form on your website:
- Laravel catches the POST request from the website form.
- The Trasol integration automatically maps your web form fields (First Name, Last Name, Email, Company) to the standard Salesforce Lead object fields.
- A new Lead record is instantiated in Salesforce in real-time — no delay, no queue, no manual step.
To test it, simply fill out your website's contact form and watch the Lead instantly appear in your Salesforce Sales Console.
The moment the visitor clicked "Send Now", the Laravel server caught the POST request, authenticated to Salesforce using the Consumer Key and Secret, and created a Lead record via the REST API — all in under 2 seconds, before the success popup even appeared.
Website Form Field to Salesforce Lead Field Mapping
Here is the complete mapping between your website form fields and their Salesforce Lead equivalents:
| Website Form Field | Salesforce Lead Field | API Field Name | Type |
|---|---|---|---|
| First Name | First Name | FirstName | Required |
| Last Name | Last Name | LastName | Required |
| Email Address | Email | Required | |
| Phone Number | Mobile | MobilePhone | Optional |
| Message / Notes | Description | Description | Optional |
| Company Name | Company | Company | Required |
| Lead Source | Lead Source | LeadSource | Auto: "Web" |
| Submission Time | Created Date | CreatedDate | Auto-set |
How It Works Under the Hood
For architects and developers who want the full technical picture, here is exactly what happens at the API level on every form submission:
- Visitor submits the contact form. The browser POSTs form data to the Laravel application endpoint on the server.
- Laravel reads the
SALESFORCE_CLIENT_IDandSALESFORCE_CLIENT_SECRETfrom the .env file and sends a POST to https://login.salesforce.com/services/oauth2/token. - Salesforce validates the credentials against the External Client App and returns an access_token and instance_url.
- Laravel POSTs to {instance_url}/services/data/v66.0/sobjects/Lead/ with the form data mapped to Salesforce field names in the JSON body.
- Salesforce creates the Lead record, fires assignment rules and flows, and returns the new Lead ID.
- Laravel returns HTTP 200 to the website. The visitor sees the success confirmation. The entire round-trip takes under 2 seconds.
- The Consumer Secret never touches a browser. It lives only in the server's .env file — the critical security difference from standard Web-to-Lead.
- No Apex required. The package contains only an External Client App (declarative metadata). Zero custom code in the customer's org means zero code execution risk.
- No 500/day ceiling. This goes through the Salesforce REST API with proper authentication, using the org's standard API call limits — not the Web-to-Lead queue.
- Duplicate rule compatible. Because the Lead is created via API using a named integration user, Duplicate Rules can be configured to give you cleaner de-duplication control.
- Namespace isolated. All custom components are prefixed with
WebLeadTrasolAI__— no conflicts with any existing org configuration.
Summary
Standard Web-to-Lead will always have a place for rapid prototyping. But for organisations running custom Laravel web applications that require high volume (bypassing the 500/day limit), strict data validation, and enterprise-grade security, a modern API-driven approach is mandatory.
By leveraging 2nd-Generation Packaging and the modern External Client App framework, Web Lead Trasol AI gives Salesforce Admins and web developers the perfect bridge to seamlessly — and securely — sync their data directly into the Salesforce Lead object, with every automation rule, flow, and assignment firing the moment the Lead is created.
The true measure of a great integration is not just that it works — it's that it works invisibly. Your sales team should never think about where a lead came from or how it got there. They should open Salesforce and see qualified, clean leads ready to action. That is what Web Lead Trasol AI is built to deliver.