Webhooker

Webhooker is a cloud gateway for accepting, checking, retaining and forwarding inbound webhooks. It is best suited to development and operations teams coordinating several providers and destinations that need inspection, replay and delivery controls. Its strongest case is recoverable, security-conscious routing; teams must still make consumers idempotent because deliveries are at least once.

Overview

Webhooker accepts HTTP POST webhooks from services including Stripe, GitHub and Shopify, then sends them to configured services. Per-source HMAC-SHA256 and SHA1 verification rejects invalid signatures with HTTP 401, creating a clear security boundary before application code processes an event.

Every destination receives six delivery attempts over approximately five hours. Failed events can be resent from a dead letter queue, while one-click replay supports reprocessing after a fix or investigation. This is a meaningful advantage over direct provider-to-application delivery, but the at-least-once guarantee means duplicate events are possible. Payment, order and other state-changing consumers need idempotency safeguards.

Key features

Routing and request control

Payload transformations can tailor one incoming event for different destinations. Header injection and outbound request signing help services that require their own credentials or a specific request format, reducing integration-specific code in each receiver.

Inspection and recovery

A live event stream over SSE, delivery history and failure alerts in the app or by email make delivery problems visible. Event inspection and replay are particularly useful when debugging provider payloads or recovering from a temporary outage. The Management API exposes dashboard operations over HTTP for automation, and the official CLI forwards incoming webhooks to localhost on Linux, macOS and Windows, which suits local development.

Data handling

Ingest, storage and delivery run on Hetzner servers in Germany, with backups in EU data centers. Event retention is 14, 30 or 90 days by plan, and paid plans include access to a data processing agreement. The separate log-retention figure is 30 days. These EU-hosting and retention choices may help teams with regional data requirements, while the right plan depends on how long investigations and replays must remain possible.

Pricing

The Free plan is a practical way to run a small number of integrations, but three sources and nine destinations leave little room for a growing estate. Pro is the more balanced choice for a team that needs substantially higher throughput, longer retention and shared access. Team is aimed at high-volume routing or broad multi-service operations, with a tenfold Pro event allowance and 25 members. Plans may exceed their monthly event quota by up to 20% without charge and do not bill overages, which softens occasional spikes but does not remove quota planning. Paid plans have custom pricing only where a plan is not shown; the published Pro and Team rates are the stated terms.

Platforms

Webhooker is delivered as a cloud service with API access on Linux, macOS and Windows, plus web access. Its CLI has builds for Linux, macOS and Windows and forwards incoming events to localhost. The Management API is suitable for HTTP-based dashboard automation.

Who it's for

Choose Webhooker when several third-party webhook sources feed multiple internal services and you need signature rejection, controlled retries, event history and replay in one gateway. It is also a fit for teams wanting EU-based hosting and a paid-plan data processing agreement. It is less suitable when consumers cannot tolerate duplicates, when self-hosting is mandatory, or when a small integration will remain below the Free plan's modest source and destination limits.

Pros and cons

Pros

• Strong delivery recovery: six attempts, dead-letter resends and one-click replay give operators concrete ways to recover failed events.
• Useful security controls: per-source HMAC-SHA256/SHA1 checks and HTTP 401 rejection stop invalid requests early.
• Flexible destinations: transformations, header injection and outbound signing accommodate differing receiver requirements.
• Clear scaling steps: Pro and Team raise event, source, destination, retention and member limits substantially.
• EU data location: German hosting, EU backups and paid-plan DPA support region-conscious deployments.

Cons

• Duplicate handling is required: at-least-once delivery shifts idempotency work to every consumer.
• Free limits are narrow: 10,000 events, three sources and nine destinations can constrain a growing integration setup.
• Retention varies by plan: the Free plan keeps events for 14 days, so longer investigations require Pro or Team.
• Cloud-only deployment: organizations requiring a self-hosted gateway need another product.

Alternatives

Hookdeck is worth choosing for a freemium service with a free trial, self-hosted support and a Developer allowance of up to 10,000 events with three-day retention and one user.

Dispatch suits teams wanting a free 10,000-event tier with two members and public projects, or a paid Team option, while its free plan keeps only three days of history and drops over-limit events at ingress.

Hookbridge is an alternative when message-based tiers from 1,000 free messages through 50,000 at Pro fit your volume model.

RelayHQ is better for very small setups needing three endpoints, 500 requests per month and 24-hour logs, but its free tier has no automatic retry.

Webhook Relay offers a free starter allowance of 150 webhooks per month, two destinations and one input.

Hookdeck Outpost is the choice for an Apache-2.0 open-source, self-hosted binary or Docker deployment.

WebhookX provides a free Community version and a Team plan at $39 per month.

Kiosk is a free, open-source PDF reader rather than a webhook gateway.

Verdict

Webhooker is a strong choice for teams that need verified inbound events, multi-destination controls and practical replay and recovery, especially with EU hosting. Look elsewhere if duplicate delivery is unacceptable, self-hosting is essential, or your traffic and integration count fit only a smaller, simpler free tier.