Inbound webhook gateway
One ingest URL for Stripe, GitHub, Shopify, or anything else that sends webhooks. Webhooker checks the signature, stores the event so it can't vanish, and delivers it to your services with retries, replay, and a full per-attempt history.
free plan · 10,000 events/month · no card required · hosted in the EU
How it works
In three stages, and the event survives every one of them. Webhooker verifies the signature, writes the event to durable storage before answering the provider, and only then delivers it to your services. Accepting an event and delivering it are separate, transactional steps, so a slow or broken destination never costs you a webhook.
New to the mechanics? Start with how webhooks actually work, or read what a webhook gateway does that a plain endpoint doesn't.
STAGE 01
Your provider calls a unique ingest URL. The signature is checked against the source's scheme before the payload is accepted. A bad signature gets a 401 and is logged for audit, never delivered.
HMAC-SHA256 / SHA1STAGE 02
The event is written to a durable queue before the provider gets its 200 OK, in single-digit milliseconds. Nothing is acknowledged until it is stored. Webhooker acknowledges 99% of inbound webhooks in under 10 milliseconds, measured server-side.
p99 < 10 ms server-sideSTAGE 03
Competing workers fan the event out to your destinations: six attempts over about five hours with exponential backoff, status-conditional retries and a circuit breaker per destination. Failures land in a DLQ you can resend from.
at-least-onceFeatures
Everything between the provider's POST and your handler: signature verification, retries with a circuit breaker, per-destination transformations, signed outbound requests, a live event tail with replay, and failure alerts. It is the unglamorous plumbing every integration needs, built once and shared by all your sources and destinations.
If you are still deciding whether to poll or be pushed, we lay out webhooks versus polling an API and where each one wins.
Per-source HMAC-SHA256 and SHA1 schemes checked before a payload is accepted. Forged requests get a 401 and are never delivered.
Exponential backoff, conditional retries by HTTP status, and a per-destination circuit breaker that stops hammering a downed service.
Declarative, per-destination payload reshaping and header injection. Send each service exactly the shape it expects.
Forwarded requests are signed, so your destinations can verify every delivery really came from Webhooker.
Real-time event stream over SSE, full history, and a per-attempt delivery log with one-click resend of any event.
Set alerts per source and hear about it in the app or by email when a delivery runs out of retries or a destination's circuit opens.
<10 ms
to acknowledge 99% of events
at-least-once
delivery guarantee, duplicates possible
6 attempts
per destination over about five hours
SSE
streams incoming events live
Webhooker acknowledges 99% of incoming webhooks in under 10 ms server-side and delivers every event at least once, so your consumer should expect duplicates.
EU data residency
On Hetzner servers in Germany, inside the European Union, full stop. Payloads, delivery logs and backups are never mirrored to a US cloud region. When a customer or auditor asks where your webhook data lives, the answer is one word: Germany.
The GDPR question underneath it is whether a payload is personal data at all — we go through it field by field.
Ingest, storage and delivery workers run on Hetzner in Germany, and backups stay in EU data centers. Not "EU-first" with exceptions buried in the fine print. EU only.
Retention limits are enforced, deleted means deleted, and a data processing agreement is available for every paid plan. See the privacy policy for the details.
Events expire after 14, 30 or 90 days depending on plan. Export what you need before then, or delete it earlier. It's your data.
Pricing
Webhooker is free for up to 10,000 events a month. Pro costs €29 a month and Team €99, and yearly billing gives you two months free. The core pipeline is on every plan: verification, retries, transformations, replay and alerts. Paid plans add a DPA on Pro and Team, plus ordered delivery and a static outbound IP on Team.
Free
€0 / month
Side projects and evaluation.
Pro
€29 / month €290 / year
Production workloads for small teams.
Team
€99 / month €990 / year
High volume, ordered delivery, static IP.
Destinations are a shared pool — any source can use as many of them as it needs. Yearly billing costs ten months for twelve, on Pro and Team.
FAQ
Webhooker is an EU-hosted inbound webhook gateway. You give Stripe, GitHub, Shopify or any other provider one ingest URL; Webhooker verifies each webhook's signature, stores the event durably on servers in Germany, and delivers it to your own services with retries, a dead letter queue, replay and a full delivery log. The free plan covers 10,000 events a month.
A webhook gateway sits between the services that send webhooks and the services that consume them. Webhooker receives each event on a unique ingest URL, verifies its signature, writes it to durable storage, and then delivers it to your destinations with retries and a full per-attempt log.
Webhooker keeps the event. Each destination gets six delivery attempts over about five hours with exponential backoff, a per-destination circuit breaker pauses delivery to a downed service, and anything that still fails lands in a dead letter queue. From there you can resend a single event or a whole batch once your service is back.
In Germany, inside the European Union. Webhooker's ingest, event storage and delivery workers run on Hetzner servers in Germany, backups stay in the EU, and webhook payloads are not transferred outside the EU. Events are deleted automatically when your plan's retention window ends: 14, 30 or 90 days.
Yes. Webhooker keeps every event for your plan's retention window, along with the full delivery history of each attempt. Any event can be resent to any destination with one click, and dead-lettered events can be replayed in bulk.
Any service that sends an HTTP POST. Webhooker verifies per-source HMAC-SHA256 and SHA1 signatures, the schemes used by Stripe, GitHub, Shopify and most other providers, and answers a bad signature with a 401: the event is kept for your audit log but never delivered.
From the blog
Signature verification, retries, idempotency and replay — written from running the thing, not from the spec.
A webhook is an HTTP request one application sends to another when something happens. What that looks like on the wire, what a webhook URL is, where webhooks beat polling and where they are the wrong tool.
A webhook gateway sits between the apps that send you webhooks and your code — it verifies, stores, retries and replays every event, so a plain webhook receiver in your app never has to.
Stripe signs webhooks with the Stripe-Signature header. How the signed payload is built, how to recompute the HMAC-SHA256 over the raw bytes, and how the timestamp tolerance stops replays.
Most explanations stop at "the provider sends you a POST". Here is the real request, header by header, what your 200 actually means, and what the sender does when you do not answer.
Svix, Hookdeck and Webhooker compared on direction, hosting region, retention, billing unit and DPA, with every competitor fact linked to the vendor's own page.
How Stripe webhooks behave in production. Which events to handle for Checkout and subscriptions, the three-day retry window, duplicates and ordering, testing with stripe listen, and recovering events after an outage.
Why this exists
We built Webhooker because we were tired of rebuilding the same webhook plumbing, verification, retries and replay, in every new project. It stays small and focused on purpose, with a bias for boring reliability.
Create a source, paste the URL into Stripe or GitHub, and watch events arrive in the live tail. Verification, storage and delivery are already handled. The quick start takes four steps, and the ingest URL reference lists every response code.
https://app.webhooker.eu/in/{your-token}
Webhooker