API EloCRM
REST · oRPC · Webhooks

{
  "event": "invoice.paid",
  "timestamp": "2026-04-26T10:32:11.412Z",
  "data": {
    "type": "invoice.paid",
    "orgId": "org_acme_xyz",
    "invoiceId": "ckxyz...",
    "clientId": "ckabc...",
    "actorId": "usr_..."
  }
}

import { createHmac, timingSafeEqual } from "node:crypto";
import express from "express";

const app = express();

function verifyEloSignature(rawBody, signature, secret) {
  const expected = createHmac("sha256", secret).update(rawBody).digest("hex");
  const a = Buffer.from(expected);
  const b = Buffer.from(signature);
  return a.length === b.length && timingSafeEqual(a, b);
}

app.post(
  "/webhooks/elocrm",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const ok = verifyEloSignature(
      req.body,
      req.headers["x-webhook-signature"],
      process.env.ELO_WEBHOOK_SECRET,
    );
    if (!ok) return res.status(401).send("Invalid signature");
    const payload = JSON.parse(req.body.toString());
    // ... traiter en async, répondre tout de suite
    res.status(200).end();
  },
);

import hmac, hashlib, os
from flask import Flask, request, abort

app = Flask(__name__)

def verify_elo_signature(raw_body: bytes, signature: str, secret: str) -> bool:
    expected = hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature)

@app.post("/webhooks/elocrm")
def receive_elo():
    if not verify_elo_signature(
        request.get_data(),
        request.headers.get("X-Webhook-Signature", ""),
        os.environ["ELO_WEBHOOK_SECRET"],
    ):
        abort(401)
    # ... traiter en async, répondre tout de suite
    return "", 200

<?php
$rawBody   = file_get_contents("php://input");
$signature = $_SERVER["HTTP_X_WEBHOOK_SIGNATURE"] ?? "";
$secret    = getenv("ELO_WEBHOOK_SECRET");

$expected = hash_hmac("sha256", $rawBody, $secret);
if (!hash_equals($expected, $signature)) {
    http_response_code(401);
    exit("Invalid signature");
}
http_response_code(200);
// ... traiter en async (queue, job worker, etc.)

curl -X POST https://crm.thiagency.be/api/rpc/clients/list \
  -H "Authorization: Bearer thia_sk_abc123..." \
  -H "Content-Type: application/json" \
  -d '{}'

curl -X POST https://crm.thiagency.be/api/rpc/clients/create \
  -H "Authorization: Bearer thia_sk_abc123..." \
  -H "Content-Type: application/json" \
  -d '{
    "firstName": "Jean",
    "lastName": "Dupont",
    "email": "jean@dupont.be",
    "companyName": "Dupont SA"
  }'

const ELO_API = "https://crm.thiagency.be/api/rpc";
const ELO_KEY = process.env.ELO_API_KEY; // jamais hardcodé

async function listClients() {
  const res = await fetch(`${ELO_API}/clients/list`, {
    method: "POST",
    headers: {
      Authorization: `Bearer ${ELO_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({}),
  });
  if (!res.ok) {
    throw new Error(`ELO API ${res.status}: ${await res.text()}`);
  }
  const { json } = await res.json();
  return json;
}

const clients = await listClients();
console.log(`${clients.length} clients chez THIA'gency`);

import os, requests

ELO_API = "https://crm.thiagency.be/api/rpc"
ELO_KEY = os.environ["ELO_API_KEY"]

def list_invoices():
    r = requests.post(
        f"{ELO_API}/invoices/list",
        headers={
            "Authorization": f"Bearer {ELO_KEY}",
            "Content-Type": "application/json",
        },
        json={},
        timeout=10,
    )
    r.raise_for_status()
    return r.json()

invoices = list_invoices()
print(f"{len(invoices)} factures")