Sharing evidence with lead buyers

Why sharing matters

If you need to share leads with a lead buyer or collect leads from a lead generator, consent evidence must move with the lead. The company running the website (the lead generator) captures evidence when a consumer submits a form; the company that purchases and dials the lead (the lead buyer) needs that proof for TCPA compliance.

ExpressConsent makes this handoff simple: generate a share URL when you capture the CDR, pass it along with the lead, and the buyer claims it with their own API key. One URL per lead, usable by whoever receives it.

Roles

Billing

Option 1: Auto-share at capture time (recommended)

The simplest approach. Pass autoShare: true to captureCDR() and the share URL is generated server-side during the upload. No extra API call needed.

document.getElementById('form').addEventListener('submit', async () => {
  const result = await window.ExpressConsent.captureCDR({
    autoShare: true,
    custom: { leadId: 'your-internal-lead-id' },
  });

  // result.cdrId        → "abc_123"
  // result.shareUrl     → "https://api-next.expressconsent.com/v1/shares/xYz..."
  // result.shareToken   → "xYz..."
  // result.shareExpiresAt → 1741234567890

  // Post the lead to your buyer — include the share URL
  await fetch('https://buyer-crm.example.com/leads', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
      phone: formData.phone,
      email: formData.email,
      consentUrl: result.shareUrl,
      cdrId: result.cdrId,
    }),
  });
});

The returned shareUrl is a full absolute URL. Pass it directly to your lead buyer — they use it to claim the evidence with their own ExpressConsent API key.

Custom expiry

By default, share tokens expire after 30 days (max 2 years). To customize, pass an options object instead of true:

// Custom 7-day expiry (default is 30 days)
const result = await window.ExpressConsent.captureCDR({
  autoShare: { expiresInMs: 7 * 24 * 60 * 60 * 1000 },
});

Option 2: Share via API (server-side)

If you need to generate share URLs from your server (for example, sharing a CDR after the fact), use the API endpoint. This requires the CDR to be collected first.

# Generate a share URL server-side (alternative to autoShare)
curl -sS -X POST \
  -H "X-API-Key: $EC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"expiresInMs": 2592000000}' \
  "$EC_API_BASE_URL/v1/cdrs/abc_123/share"

See the POST /v1/cdrs/:cdrId/share reference for full details.

How lead buyers claim evidence

The lead buyer receives the share URL (via your lead posting, CRM, etc.) and claims it using their own ExpressConsent API key:

# Lead buyer claims the CDR using the share URL
curl -sS -X POST \
  -H "X-API-Key: $BUYER_API_KEY" \
  "https://api-next.expressconsent.com/v1/shares/xYzToken123"

Response

{
  "ok": true,
  "data": {
    "claimed": true,
    "alreadyClaimed": false,
    "cdrId": "abc_123",
    "domainId": "example.com",
    "shareEventId": "se_a1b2c3d4"
  }
}

After claiming:

• The CDR appears under the buyer’s organization in the dashboard
• The buyer can view, download the evidence image, or generate a PDF report
• Re-claiming the same URL is idempotent (alreadyClaimed: true)

End-to-end flow

1. Consumer submits form on the lead generator’s site.
2. Lead generator calls captureCDR({ autoShare: true }) — gets back cdrId + shareUrl.
3. Lead generator posts the lead to the buyer’s CRM/API, including the shareUrl.
4. Lead buyer calls POST shareUrl with their API key to claim the evidence.
5. Evidence is now under both organizations. The buyer can access it in the dashboard or via the API.

Co-registration & multiple buyers

If you sell the same lead to multiple buyers, each buyer claims the same share URL independently. Each claim is tracked as a separate share event.

For co-registration flows where different buyers should see different pages, use sub-group packages to control which CDRs each buyer can access.

Related docs