How to build a lead capture CRM for your business with Bolt (no coding required)

Rule of thumb: if your lead volume moves around, or the four products above are already talking to each other through a fifth, building your own pays for itself inside a year and never charges you by the response again. If you are one person still finding out whether anybody wants the thing, rent it for now and come back when a meter starts deciding your marketing for you.

* Supabase’s free tier is a building tier rather than a running-a-business tier: 500 MB of database, 2 active projects, and a pause after a week without activity. That pause matters more here than on most apps, because the form embedded on your website goes down with the project, and a lead that arrives while nobody was signed in is not queued anywhere. The Pro plan, from $25/mo, keeps it awake.

Both columns end the same way: the code is yours, nothing charges you by the response, and the thousandth lead in a month costs exactly what the first one did. The difference is whose hours go in: a developer’s, invoiced at $13k-$53k, or your own, spent describing the app and checking what comes back.

Prices and rates from supabase.com, developex.com and bolt.new, checked August 2026.

The GitHub step comes before Bolt exists for you at all. Everything after it happens inside the browser tab Bolt opens, with no install.

1. 01

   Repository first, then the project

   Bolt cannot open a zip file, so a GitHub repository is where this starts rather than where it ends up. Create it empty, connect it, and let the first prompt fill it.

   PromptSet up the projectCopy

   Scaffold a React 18 + Vite + TypeScript project with Tailwind and the Supabase JS client, reading VITE_SUPABASE_URL and the publishable key (the sb_publishable_… key that replaced the older anon key) from environment variables, and confirm .env is in .gitignore so neither value reaches the repository. This project is a lead capture CRM, so hold to these words throughout: lead, form, submission, activity, rep, source, status. Commit once it boots.

   Fixing the vocabulary in the first prompt matters more here than elsewhere, because every later prompt reloads the project and reads back what these words were used for.

2. 02

   Decide what a lead is

   Four tables carry the whole product. Ask for the schema on its own rather than bundled with screens, both because it is the expensive thing to change later and because a narrower prompt costs less here.

   PromptSet up your recordsCopy

   Create the Supabase tables and migrations, and nothing else in this message. Leads: name, email, company, phone, source (form, chat, import or manual), status (new, contacted, qualified, converted or rejected), a score, and the rep it is assigned to. Forms: title, slug, published flag, and fields as JSON. Submissions: the raw answers, the form they came from, and the lead they created. Activities: a lead, a type and a note. Every table gets a created_at. Show me the SQL before applying it.

   Keeping the raw submission beside the lead it created is what lets you fix a bad field mapping later without losing what somebody actually typed.

3. 03

   Add sign-in and the two roles

   An admin who runs the whole thing and a rep who works their own leads. The public form stays reachable by anyone, so say that in the same prompt.

   PromptAdd logins and the two rolesCopy

   Add Supabase Auth with email and password: sign-up, login, logout, a persisted session, and a guard that sends signed-out visitors to the login page while leaving the public form route open to anyone. Then create an app_role enum with 'admin' and 'rep', and a user_roles table linking a user_id to a role. Roles belong in that table and never on the user record itself, because a user can edit their own metadata and would simply grant themselves admin. Add a SECURITY DEFINER has_role function for the policies in the next prompt.

   Storing a role where the user can edit it is the classic Supabase privilege-escalation hole, and this prompt is written to close it.

4. 04

   Open the public door, and only that door

   The requirement that makes this app unlike the others: a stranger writes a row and reads none. Two rules, both of which have to be right at once, and worth a prompt of their own rather than being tacked onto the screens.

   PromptLock the tables to the two rolesCopy

   Enable row-level security on leads, forms, submissions and activities. A rep may select, insert and update only rows where assigned_to = auth.uid(). An admin, checked through has_role, reaches every row. Every insert and update needs its own WITH CHECK clause, so no one can file a row under another rep’s name or move an existing lead onto them. Migration only in this message, and show me the SQL first.

   PromptLet a stranger write one row and read nothingCopy

   Now the public path. Add a policy allowing the anonymous role to INSERT into submissions and nothing else: no select, no update, no delete, and no anonymous access to leads, activities, form content or users. Create the lead from the submission in an edge function rather than in the browser. Then show me how to prove it with no session at all: submitting the form should succeed, and requesting the leads table should come back empty rather than with an error I could mistake for a network problem.

   Get this backwards and everyone who ever filled in your form is readable by anyone who opens the browser tools on it.

5. 05

   Build the form builder, the embed and the routing

   The screens your visitors meet and the rule that decides who calls them. Two prompts rather than one, which keeps each reload smaller and each answer easier to check.

   PromptBuild the form builder and its embedCopy

   Build the form builder: a screen where I add fields (text, email, phone, select, checkbox), mark which are required, and publish. Add a public route at /embed/forms/:slug that renders only that form, with no navigation and no app chrome, plus an Embed tab on each form showing the iframe snippet to paste onto another site. Submitting writes a submission through the anonymous policy from the last prompt and shows a thank-you state rather than a blank screen.

   PromptAssign each new lead to a repCopy

   Add an edge function that turns a new submission into a lead: map the answers onto the lead fields, set the source, check whether that email is already a lead and attach an activity to the existing one instead of creating a duplicate, then assign it to the next active rep in turn. Make the assignment mode a setting with round-robin and unassigned as its options, and record each assignment as an activity so I can see who got what and when.

   Round-robin is one rule among several. Building it as a setting is what lets you switch to territory or product later without touching the capture path.

6. 06
   Destination

   Try it as a stranger would

   Open your own form from another browser with no session and follow one lead through. Everything after this, whether chat, campaigns or the AI features above, is another prompt, and each one is cheaper if you keep it narrow.

   PromptWalk it end to end and plan what is nextCopy

   Walk me through testing the whole flow. Signed in as an admin, publish a form. Then open its embed address in a private window with no account and submit it. Confirm the lead appears with the right source, that a rep was assigned, and that submitting the same email twice makes one lead with two activities rather than two leads. Sign in as that rep and confirm they see only their own. Fix what does not hold up, then list what to build next (live chat, campaign sequences, AI enrichment) in priority order.

Review the access rules (row-level security policies) on every table. For each one, tell me in simple terms who can view, add, edit, and delete records, confirm that people can only reach their own data while the right roles can reach more, and flag anything left open that shouldn’t be.

One rule outranks everything above it: the secret key that bypasses your access rules stays on the server. If it ever turns up in the app, in a repository, or pasted into a support ticket, rotate it in the Supabase dashboard before you do anything else.

Any of them will serve this app, and your AI coding tool can wire up whichever you pick. Two things are worth checking before the price. The licence comes first, because free does not always mean free for business use, and Vercel’s Hobby tier says plainly that it is for personal projects. The second is in the warning below, and it is the one that catches people out.

Do the multiplication before you pick. A four-step sequence sent to a thousand new leads is four thousand messages, which sits inside Resend’s free tier and costs about forty cents on SES, so at that size the price is not what you are choosing between. What you are choosing is who takes the blame when mail stops arriving. Volume changes the answer, and it changes it slowly: at a hundred thousand a month the same four steps cost $10 on SES and about $90 elsewhere.

Add one server-side "ai" function that talks to your AI provider, with the key held in server secrets and never anywhere the browser can reach. Then put an "Enrich" action on the lead view that sends the email domain and any fields we already have, asks for the company name, industry and rough size, writes them onto the lead, and marks personal-email domains as not enrichable rather than guessing. This runs on every new lead, so use the cheapest and fastest model tier.

Add a "Score" action that sends the lead’s fields, its source, and its recent activity to the ai function, asks for a 0-100 score and a one-line reason, stores both on the lead, and colours the badge by band. Sort the leads list by score by default and let a rep override it. Scoring runs on every lead too, so keep it on the same cheap, fast tier as enrichment.

Add a "Draft reply" button on the lead view that sends what the lead submitted, the page or form it came from, and any chat transcript to the ai function, and returns a short editable first email in the rep’s own tone. Show it in a modal with copy and insert actions, and never send it automatically. This is everyday writing, so use a mid-tier model rather than the cheapest or the strongest.

Pick a lighter model for the high-volume prompts above and save a stronger one for wherever the reasoning actually matters. That is the same token-budget logic as the rest of this page, applied to the app’s own AI calls instead of the build itself. When Bolt flags a missing secret, add the key through its secrets settings instead of pasting it into the chat, and keep every AI feature behind one server-side function so there’s only one key to manage.