Guide / Integrations

GitHub → HookStead → your app

Put HookStead in front of GitHub webhooks so none are lost.

1. Create a source in Hookstead

Sources → New source:

• Verify requests with: GitHub.
• Secret: a long random string; you'll give GitHub the same one. Generate it with openssl rand -hex 32.
• Dedupe header: X-GitHub-Delivery. GitHub's redeliveries reuse it, so a redelivered event isn't stored twice.

Copy the ingest URL: https://<your Hookstead>/in/<token>.

2. Add the webhook in GitHub

In the repository or organization: Settings → Webhooks → Add webhook.

• Payload URL: the ingest URL.
• Content type: application/json.
• Secret: the same secret as the source.
• Choose your events, then save. GitHub sends a ping event right away; it appears on the source's event list.

Hookstead checks X-Hub-Signature-256 (HMAC-SHA256 of the raw body) in constant time. A wrong or missing signature gets 401 and nothing is stored.

3. Forward to your app

Create a destination for your endpoint and connect the GitHub source to it. Verify Hookstead's webhook-signature in your app with the destination's secret (see the receivers). Route by the original X-GitHub-Event header, which Hookstead forwards unchanged.

Notes

• GitHub gives up after a failed delivery and only redelivers by hand. With Hookstead in front, GitHub's request succeeds as soon as Hookstead stores it, and Hookstead keeps retrying your endpoint.
• Payloads can include private repository data. Add redaction key patterns on the source (for example email) if not everyone in your workspace should see those fields. The original stays encrypted and visible only to admins.