Before you start
- A Google account and a Google Sheet you own.
- The lead webhook on your plan. Open Integrations in your dashboard: if the "Zapier, Make and CRMs" card says "Not on your plan", your plan doesn't include it. The trial does.
- About ten minutes. There's no Zapier or Make account to open and nothing to install.
Steps
- Create a new Google Sheet and give it a name, such as "Website leads". Leave it empty: the script writes the header row itself.
- In the sheet, open Extensions, then Apps Script. A code editor opens in a new tab.
- Delete what's in the editor and paste the script shown under these steps. Replace paste-a-long-random-string-here with a long random string of your own, 30 characters or more, and save.
- Click Deploy, then New deployment. Next to "Select type", click the gear and choose Web app. Set it to execute as you ("Me"), set who has access to "Anyone", and click Deploy.
- Google asks you to authorize the script, and may first warn that it hasn't verified the app. That's because the script is your own and unpublished: it asks to edit this one spreadsheet and runs under your Google account. We never see that account.
- Copy the web app URL, which ends in /exec. Add ?key= and your random string to the end of it, with no spaces.
- In your dashboard, open Integrations, find "Zapier, Make and CRMs" and paste the address in. Save it, then press "Send a test lead".
- Look at your sheet. It should now have a header row and a row for "Test lead" on +44 7700 900000. Delete that row, then leave a real inquiry on your own website and watch it arrive too.
The script to paste in step 3
It reads the lead we send, checks the key in the address, skips a lead id it already has, and adds one row. The apostrophe it puts in front of text makes Google Sheets store what a visitor typed as plain text, never as a formula.
/** @OnlyCurrentDoc */
const KEY = "paste-a-long-random-string-here";
function doPost(e) {
if (e.parameter.key !== KEY) return HtmlService.createHtmlOutput("ignored");
const data = JSON.parse(e.postData.contents);
const lead = data.lead || {};
const text = (value) => (value ? "'" + value : "");
const sheet = SpreadsheetApp.getActiveSpreadsheet().getSheets()[0];
if (sheet.getLastRow() === 0) {
sheet.appendRow(["Lead id", "Received", "Type", "Name", "Phone", "Email",
"Service", "Area", "Preferred time", "Urgent", "Other details", "Leads screen"]);
}
const seen = sheet.getRange("A:A").createTextFinder(data.id).matchEntireCell(true).findNext();
if (!seen) {
sheet.appendRow([text(data.id), new Date(data.createdAt), data.type,
text(lead.name), text(lead.phone), text(lead.email), text(lead.serviceType),
text(lead.addressOrArea), text(lead.preferredTime), lead.urgent ? "yes" : "",
text(JSON.stringify(lead.details || {})), data.dashboardUrl]);
}
return HtmlService.createHtmlOutput("ok");
}Platform steps checked on October 7, 2026 against Google for Developers: Apps Script web apps
Good to know
- What the script can't check: we sign every request, but Google doesn't pass a request's headers to an Apps Script web app, so the script can't verify our signature. The key in the address is the safeguard instead. Treat the whole address like a password. If it gets out, change KEY in the script, deploy the change and paste the new address into Integrations.
- An edit to the script isn't live until you deploy it again: Deploy, then Manage deployments, edit the deployment and choose a new version. The address stays the same.
- The script runs as you, the sheet's owner, whoever sends the request. Google's limits are on your account: 30 runs at once and 6 minutes per run, on Google's Apps Script quotas page as updated in September 2026. One lead is one short run.
- We wait 5 seconds for an answer. If Google takes longer, Integrations shows the lead as not accepted and we send it again after 5, 10, 20, 40 and 80 minutes. The script skips a lead id that's already in column A, so a retry doesn't add a second row.
- If Integrations says the address answered with a redirect, check that who has access is set to "Anyone". Any other setting sends our request to a Google sign-in page. Some Google Workspace admins switch that option off; if it's missing, use Make as in our CRM guides.
- The Type column says test for the test button and lead.created for a real lead, so you can filter tests out later.
Can't edit your website?
Every assistant has its own chat page. Link to it from your website's menu, your Google Business Profile, social media or email signature. Or use "Email this to my web person" on your Widget page to send the code to whoever runs your site.
Questions
Do I need Zapier or Make to send chatbot leads to Google Sheets?
No. The lead webhook posts straight to a script that lives in your own sheet, so there's no automation account and no monthly task limit in between. If you'd rather not paste a script, Make's free plan does the same job; the steps are in our CRM guides.
Is it safe to set access to "Anyone"?
It means anyone who has the full address can run the script, which is why the address carries a long random key and the script ignores a request without it. The script can only add rows to this one sheet: it can't read the sheet back to a caller or touch your other files. Google doesn't show request headers to the script, so it can't check our signature; keep the address private. How we sign and send leads is on our security page.
Can I add, remove or reorder the columns?
Yes. Change the header list and the row list in the script in the same way, keep the lead id in column A (the script uses it to spot a repeat), and deploy a new version. Clear the old header row first if you've changed it.
Can leads go to a sheet and a CRM at the same time?
Not from us directly: an assistant has one webhook address. Point it at Make and let one scenario write to both your sheet and your CRM, as in the HubSpot guide. Every lead still reaches you by email alert either way.