How to build a lead capture CRM for your business with Claude Code (no coding required)

Rule of thumb: if your lead volume moves around, or the four products above are already talking to each other through a fifth, building your own pays for itself inside a year and never charges you by the response again. If you are one person still finding out whether anybody wants the thing, rent it for now and come back when a meter starts deciding your marketing for you.

* Supabase’s free tier is a building tier rather than a running-a-business tier: 500 MB of database, 2 active projects, and a pause after a week without activity. That pause matters more here than on most apps, because the form embedded on your website goes down with the project, and a lead that arrives while nobody was signed in is not queued anywhere. The Pro plan, from $25/mo, keeps it awake.

Both columns end the same way: the code is yours, nothing charges you by the response, and the thousandth lead in a month costs exactly what the first one did. The difference is whose hours go in: a developer’s, invoiced at $13k-$53k, or your own, spent describing the app and checking what comes back.

Prices and rates from supabase.com, developex.com and claude.com, checked August 2026.

Nothing here is worth memorizing. These four just need to exist on your machine. From step 01 on, you say what you want and Claude Code runs the commands.

1. 01

   Get the project running

   Boot an empty app wired to your database, and hand Claude Code a short notes file so it keeps your vocabulary straight from here on. One prompt covers the whole setup.

   PromptSet up the projectCopy

   Scaffold a new React 18 + Vite + TypeScript project, add Tailwind and the Supabase JS client, then wire it to read VITE_SUPABASE_URL and the publishable key (the sb_publishable_… key that replaced the older anon key) from .env, putting .env straight into .gitignore in that same step so neither value ever reaches GitHub. Put a typed Supabase client under src/lib, then write a short CLAUDE.md describing this app and the words it uses (lead, form, submission, activity, rep) so later edits stay consistent with it.

   Sets up the project Claude Code keeps building on, plus a memory of what your nouns mean.

2. 02

   Decide what a lead is

   Four tables carry this whole product: the leads themselves, the forms that collect them, the raw submissions those forms produce, and the activity that accumulates underneath. Get this shape right and everything after it is screens.

   PromptSet up your recordsCopy

   Create the data model as Supabase migrations. Leads: name, email, company, phone, plus source (form, chat, import or manual), status (new, contacted, qualified, converted or rejected), a score, and the rep it is assigned to. Forms: a title, a slug, a published flag, and its fields as JSON. Submissions: the raw answers, the form they came from, and the lead they created. Activities: a lead, a type, a note, and who did it. Give every table a created_at. Write the migration SQL, let me review it, apply it, then regenerate the TypeScript types.

   Keeping the raw submission separate from the lead it created is what lets you fix a bad mapping later without losing what the person actually typed.

3. 03

   Let your team log in

   Two kinds of account, decided now rather than later: an admin who runs the whole thing and a rep who works their own leads. Everything in step 04 is written against this split.

   PromptAdd logins and the two rolesCopy

   Set up Supabase Auth with email and password. I need sign-up, login, logout, a session that survives a refresh, a useUser hook, and a guard that sends signed-out visitors to /login while leaving the public form route open to anyone. Then create an app_role enum with 'admin' and 'rep', and a user_roles table linking a user_id to a role. Roles belong in that table and never on the user record itself, because a user can edit their own metadata and would simply grant themselves admin. Add a SECURITY DEFINER function has_role(_user_id uuid, _role app_role) so the policies in the next step can call it without recursing.

   Storing a role where the user can edit it is the classic Supabase privilege-escalation hole, and this prompt is written to close it.

4. 04

   Open the public door, and only that door

   This is the step that makes a lead CRM different from every other app you might build. A stranger with no account has to be able to create a row, and must not be able to read one. Read what comes back from this one rather than approving it on trust.

   PromptLock the tables to the two rolesCopy

   Enable row-level security on leads, forms, submissions and activities. A rep may select, insert and update only rows where assigned_to = auth.uid(). An admin, checked through has_role, reaches every row. Every insert and update needs its own WITH CHECK clause, so no one can file a row under another rep’s name or move an existing lead onto them. Put the policies in a migration.

   PromptLet a stranger write one row and read nothingCopy

   Now the public path. Add a policy allowing the anonymous role to INSERT into submissions, and nothing else: no select, no update, no delete, and no anonymous access to leads, forms content, activities or user data. The lead itself is created from the submission by a server-side function rather than by the browser. Then show me how to prove it: with no session at all, submitting the form must succeed, and asking for the leads table must come back empty rather than with an error I could mistake for a network problem.

   Get this backwards and every lead you have ever collected is readable by anyone who opens the browser tools on your own form.

5. 05

   Build the form, the embed, and the rule that assigns it

   Now the part your visitors actually meet, plus the thing that decides who calls them. Both belong in the same step because a form nobody owns is a form nobody answers.

   PromptBuild the form builder and its embedCopy

   Build the form builder: a screen where I add fields (text, email, phone, select, checkbox), mark which are required, and publish. Then a public route at /embed/forms/:slug that renders just that form with no navigation and no app chrome, and an Embed tab on the form showing the iframe snippet to paste onto another site. Submitting writes a submission row through the anonymous policy from step 04, and shows a thank-you state rather than a blank screen.

   PromptAssign each new lead to a repCopy

   Add a server-side function that turns a new submission into a lead: map the answers onto the lead fields, set the source, check whether that email already exists and attach a new activity to the existing lead instead of creating a duplicate, then assign it to the next active rep in turn. Make the assignment mode a setting with round-robin and unassigned as the options, and record the assignment as an activity so I can see who got what and when.

   Round-robin is one rule among several. Building it as a setting is what lets you switch to territory or product later without touching the capture path.

6. 06
   Destination

   Try it as a stranger would

   Open your own form the way a visitor will, from a different browser with no session, and follow one lead all the way through. From here every addition, whether chat, campaigns or the AI features above, is one more prompt.

   PromptWalk it end to end and plan what is nextCopy

   Run the app and walk me through testing the whole flow: sign in as an admin, publish a form, then open its embed URL in a private window with no session and submit it. Confirm the lead appears with the right source, that it was assigned to a rep, and that the same email submitted twice becomes one lead with two activities. Then sign in as that rep and confirm they see their own leads and no others. Fix whatever does not hold up, then list what to add next (live chat, campaigns, the AI enrichment) in priority order.

Review the access rules (row-level security policies) on every table. For each one, tell me in simple terms who can view, add, edit, and delete records, confirm that people can only reach their own data while the right roles can reach more, and flag anything left open that shouldn’t be.

One rule outranks everything above it: the secret key that bypasses your access rules stays on the server. If it ever turns up in the app, in a repository, or pasted into a support ticket, rotate it in the Supabase dashboard before you do anything else.

Any of them will serve this app, and your AI coding tool can wire up whichever you pick. Two things are worth checking before the price. The licence comes first, because free does not always mean free for business use, and Vercel’s Hobby tier says plainly that it is for personal projects. The second is in the warning below, and it is the one that catches people out.

Do the multiplication before you pick. A four-step sequence sent to a thousand new leads is four thousand messages, which sits inside Resend’s free tier and costs about forty cents on SES, so at that size the price is not what you are choosing between. What you are choosing is who takes the blame when mail stops arriving. Volume changes the answer, and it changes it slowly: at a hundred thousand a month the same four steps cost $10 on SES and about $90 elsewhere.

Add one server-side "ai" function that talks to your AI provider, with the key held in server secrets and never anywhere the browser can reach. Then put an "Enrich" action on the lead view that sends the email domain and any fields we already have, asks for the company name, industry and rough size, writes them onto the lead, and marks personal-email domains as not enrichable rather than guessing. This runs on every new lead, so use the cheapest and fastest model tier.

Add a "Score" action that sends the lead’s fields, its source, and its recent activity to the ai function, asks for a 0-100 score and a one-line reason, stores both on the lead, and colours the badge by band. Sort the leads list by score by default and let a rep override it. Scoring runs on every lead too, so keep it on the same cheap, fast tier as enrichment.

Add a "Draft reply" button on the lead view that sends what the lead submitted, the page or form it came from, and any chat transcript to the ai function, and returns a short editable first email in the rep’s own tone. Show it in a modal with copy and insert actions, and never send it automatically. This is everyday writing, so use a mid-tier model rather than the cheapest or the strongest.

Each prompt above picks the model that fits the job. As a rule of thumb, that is Haiku for high volume, Sonnet for everyday writing, and Opus for deeper reasoning. Model names move faster than this page does, so check the current list in the Claude docs (linked in the references below) before you build. Send every one of these prompts through that same ai function, so one key and one set of rules governs all of them.