Thanks DJ, that's a very helpful comment.
It very well could be that I am encrypting it wrong. (I really wish Munchkin could give some kind of status code feedback if this was the case.)
This is how I am encrypting it (using Ruby, though I'm not assuming you know this particular function):
Digest::SHA1.hexdigest( encrypt_key + email_address )
And the actual function call in Javascript is:
Munchkin.munchkinFunction('associateLead', {email: 'grant@email.address'}, '<hex from above>');
The email address I'm using does correspond with an existing lead. Do those calls look basically correct?
If yes, then it's possible I'm not using the right key. It's a length-44 hexidecimal string, right? I'm using the same key that I use for my Marketo SOAP API calls. Am I perhaps mistaken in assuming that I can/should use the same key for SOAP and Munchkin?