HookSteadBETA

Webhook monitoring · Hosted in Germany

See every webhook. Retry the ones that failed.

HookStead sits between your providers and your app: it records every webhook, forwards it with signatures and retries, and shows you exactly what happened at every attempt.

Start freeRead the docs

10,000 events a month free. No card needed.

One webhook, start to finish

  1. Provider

    Stripe, GitHub, Shopify…

  2. Signature check

    HMAC verified on arrival

  3. HookStead

    Stored, then queued

  4. Your endpoint

    api.yourapp.com

The provider sends a webhook, HookStead verifies and stores it. The first delivery attempt fails with a 503, HookStead waits with backoff, and the second attempt succeeds.

01 / How it works

Three steps to webhooks you can trust

  1. 01

    Point your provider at HookStead

    Create a source and paste its URL into Stripe, GitHub, Shopify or your own app. Signatures are verified on arrival, so forgeries never get in.

  2. 02

    Connect your endpoint

    Add a destination. Every event is forwarded byte-for-byte, signed with your own secret, and retried with backoff until your endpoint says yes.

  3. 03

    See, fix, replay

    Every request and every attempt is on record. When something breaks, find it, fix your endpoint, and retry or replay. Nothing is lost.

02 / Features

Built for the day something breaks

Webhooks fail quietly. HookStead makes them loud, visible and recoverable.

Nothing acknowledged is lost

Events are stored before your provider gets its 2xx, and deliveries are retried from the database, not memory. Redis outages and crashed workers included.

Signed deliveries

Standard Webhooks signatures on every attempt, secret rotation with an overlap window, and a stable webhook-id so you can dedupe.

Search everything

Find events by text, header, JSON path, source, time or delivery outcome. Open any delivery to see each attempt's request, response and timing.

Retry, replay, bulk retry

One click, or a thousand failed deliveries at once. Idempotency keys mean a double click never sends twice.

Alerts that don't spam

Failure rate, failures in a row, dead deliveries, quiet sources. One email when it breaks and one when it recovers, with a quiet period for flapping.

Private by default

Secrets and raw payloads are encrypted at rest, sensitive fields are redacted for display, and every view of an original request is audit-logged.

03 / Developers

Standard Webhooks, all the way through

Your endpoint checks one signature, in any language, with any Standard Webhooks library or ten lines of code. Example receivers for Node, Python and Go are tested against real deliveries.

verify.ts
const signed = `${id}.${timestamp}.${rawBody}`;
const expected = createHmac("sha256", key)
  .update(signed).digest("base64");

const ok = header.split(" ").some((s) =>
  s === `v1,${expected}`);   // real code: timingSafeEqual

04 / Pricing

Start free, pay when it matters

Every plan has every feature. Plans differ in volume and retention.

Free

€0/ month

Free forever, no card needed

For side projects and trying HookStead out.

  • 10,000 events / month
  • 3 days retention
  • 1 workspaces
  • 3 sources per workspace
Start free

ProMost popular

€29/ month

or €290 / year (two months free)

For production apps with real traffic.

  • 500,000 events / month
  • 14 days retention
  • 3 workspaces
  • 25 sources per workspace
Start with Pro

Team

€99/ month

or €990 / year (two months free)

For teams running many integrations.

  • 5,000,000 events / month
  • 30 days retention
  • 10 workspaces
  • 100 sources per workspace
Start with Team

Compare plans in detail

05 / Learn

New to webhooks?

Practical guides on how webhooks work, how to verify signatures and how to survive retries and duplicates.

All webhook guides

06 / FAQ

Questions

What happens when my endpoint is down?
HookStead keeps the event and retries with exponential backoff and jitter, honoring Retry-After, up to your destination's attempt limit. Then the delivery is marked failed, an alert can email you, and you retry it once you're back.
Do I still need to verify the provider's signature?
No: HookStead verifies it on arrival and rejects anything forged. Verify HookStead's own webhook-signature instead. It's fresh on every attempt, unlike provider signatures, which expire after a few minutes.
Can I self-host it?
Yes. It ships as Docker images with a production compose file. With billing turned off, every organization gets one plan's limits and nothing talks to Stripe.
What counts toward my monthly events?
Each webhook received, and each replayed delivery. Retries of the same delivery are free. Usage resets on the 1st of each month (UTC).

Your next webhook outage, solved in minutes.

Set up in five minutes. Free up to 10,000 events a month.

Start free