HookSteadBETA

HubSpot webhooks, without the lost events

Receive HubSpot webhook subscriptions reliably: v3 signatures checked on arrival, events stored, retried and replayable.

Start freeRead the docs

Common problems, solved

The v3 signature covers the exact URL, so proxies and rewrites break verification.
HookStead checks the signature against the URL HubSpot actually called, with HubSpot's decoding rules.
Signatures expire after 5 minutes, so you can't re-verify a request later.
HookStead verifies once on arrival; retries and replays carry HookStead's own fresh signature.

Set up in five minutes

  1. 01In your HubSpot developer account, open your app → Webhooks and set the target URL to your HookStead source URL.
  2. 02Create the subscriptions you need (for example contact.creation) and activate them.
  3. 03Copy the app's client secret into HookStead. HubSpot signs with X-HubSpot-Signature-v3.
How HookStead verifies HubSpot
Source optionHubSpot signature (v3)
Signature headerX-HubSpot-Signature-v3
SchemeHMAC-SHA256 over method, URL, body and timestamp, base64; at most 5 minutes old