Contact Scraper — Integrations & Webhooks Support Guide

This guide provides step-by-step instructions for integrating the Contact Scraper Chrome Extension with automation platforms such as Make.com and Zapier, as well as CRMs.

1. Make.com Integration (Google Sheets, HubSpot, Notion, CRM)

A. Setting Up the Webhook in Make.com

1. Create a new scenario in Make.com and add the Webhooks module.

2. Choose Custom Webhook (or Gateway Webhook) and click Create a webhook / Add.

3. Configure the webhook settings:

o Webhook Name: e.g., Contact Scraper Webhook

o API Key authentication: Leave empty (default) or click Add API Key if you require authentication.

o IP restrictions: Leave empty.

o Data structure: Leave empty (Make will auto-detect from the payload).

o Get request headers / HTTP method: Set to No (default).

o JSON pass-through: Set to No (default) — critical so Make parses fields into individual variables.

4. Click Save. Make will generate your unique webhook URL (e.g., https://hook.us2.make.com/xxxxxx).

5. Copy the URL.

B. Connecting in the Chrome Extension

1. Open the Contact Scraper extension and click the Settings (⚙️) gear icon.

2. In Webhook URL, paste your Make.com webhook URL.

3. If you enabled an API key in Make, paste it into Webhook API Key / Token (Optional).

4. Click Save Settings.

C. Mapping Fields in Make.com

1. In Make.com, click Re-determine data structure (or Run once).

2. In the Chrome extension, extract any contact and click ⚡ Send to Webhook.

3. Make will display “Successfully determined”.

4. Add your destination module (e.g., Google Sheets > Add a row, HubSpot > Create a contact, or Airtable > Create a record).

5. Map the fields using the reference below.

2. Zapier Integration

A. Setting Up the Trigger in Zapier

1. Create a new Zap in Zapier.

2. For Trigger, select Webhooks by Zapier.

3. For Event, select Catch Hook.

4. Click Continue (you can leave “Pick off a Child Key” blank).

5. Copy the generated webhook URL (e.g., https://hooks.zapier.com/hooks/catch/xxxx/yyyy/).

B. Connecting & Testing

1. In the Contact Scraper extension, open Settings (⚙️) and paste the Zapier URL into Webhook URL.

2. Click Save Settings.

3. Extract contacts on any page and click ⚡ Send to Webhook.

4. In Zapier, click Test trigger. You will see the incoming contact record with all top-level variables loaded.

3. Canonical Payload Schema Reference

Every record dispatched by the webhook contains the following top-level keys:

4. Multi-Contact Dispatch Behavior

· When scraping a page with multiple contacts, the extension automatically iterates and sends each contact as its own individual webhook request.

· This ensures your automations in Make.com and Zapier execute once per lead, creating distinct records in Google Sheets, CRM platforms, or email sequences without requiring complex looping steps.

5. Other Export Options

A. Google Contacts

· Click 👥 Google Contacts for direct one-click cloud synchronization through the Google People API.

· Contacts appear instantly in your Google Contacts account.

B. Microsoft Outlook

· Single contact: Click 📫 Outlook to download a .vcf contact card. Click the file to open directly in Outlook with “Save & Close”.

· Multiple contacts: The extension downloads individual .vcf files into Downloads/Outlook_Contacts/ and opens File Explorer. Select all files (Ctrl+A) and drag them directly into Outlook Contacts.

· Bulk imports: Click 📄 Export CSV for universal importing via Outlook's Import/Export wizard.

6. Security & Malware Protection Quick Reference

For client security reviews, compliance verification, and IT support, the extension includes built-in safeguards:

· Pre-extraction DOM sanitization: Strips executable <script>, <style>, <noscript>, <iframe>, <object>, <embed>, and <svg> elements from an in-memory DOM clone before text extraction.

· XSS and protocol protection: Links (website, linkedin_url) are strictly sanitized to permit only http:// and https:// schemas; dangerous pseudo-protocols (javascript:, data:, vbscript:) are blocked.

· CSV formula injection defense (CWE-1236): Values beginning with formula triggers (=, +, -, @, \t, \r) are automatically escaped with single quotes to prevent command execution in Excel or Google Sheets.

· Prompt injection immunity: The Cloud Run backend enforces strict Pydantic JSON schema decoding (gemini-3.8-flash), rejecting conversational prompt injection overrides.

· vCard CRLF sanitization: Multi-line injection is neutralized in .vcf generation to prevent parser desynchronization.

For the comprehensive technical specification, see SECURITY.md.

7. Extracting from PDFs

To extract data from PDFs you have to allow the extension to access PDF URLs under Extension Management. Access Extension Management by clicking the puzzle piece icon in the right upper corner of the Chrome window. Click the Gear icon at the bottom of the list of extensions.

Select Details in the card for Contact Scraper Extension.

Then look for Allow access to file URLs and select to toggle this on.