Integrations

Hookbase integrates with popular webhook providers out of the box.

Supported Providers

Signature verification

Hookbase verifies most of the providers in its catalog. The integrations page is generated from that catalog, so it always shows the current list. The table below covers the providers that have their own guide; senders that sign with Standard Webhooks, such as Fathom, need nothing per-sender beyond their own secret.

For Postmark and Supabase, the vendor does not sign the request. You add a custom Authorization header to the webhook holding the source's signing secret, and Hookbase checks that value. Do not also set up another Authorization value for the same webhook (Postmark's Basic auth credentials, or Supabase's "Add auth header with service key"), because only one can reach Hookbase.

Generic Webhooks

A provider with no preset uses Custom Webhooks: hex HMAC-SHA256 of the raw body, read from X-Signature, X-Webhook-Signature or X-Hub-Signature-256. Those header names and that algorithm are fixed, not configurable. A sender that signs differently, or does not sign, is ingested unverified.

Quick Setup

1. Create a Source

curl -X POST https://api.hookbase.app/api/sources \
  -H "Authorization: Bearer whr_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "My Provider",
    "slug": "my-provider",
    "provider": "custom",
    "signingSecret": "your-secret"
  }'

2. Configure the Provider

Point your provider's webhook settings to:

https://api.hookbase.app/ingest/{orgSlug}/{sourceSlug}

3. Create Routes

Connect your source to destinations to start receiving webhooks.

Common Patterns

Multi-Environment Setup

Create separate sources for each environment:

/ingest/myorg/github-prod     → Production destinations
/ingest/myorg/github-staging  → Staging destinations
/ingest/myorg/github-dev      → Development/tunnels

Event-Based Routing

Use filters to route different event types:

GitHub Source → Filter: push events → CI/CD destination
GitHub Source → Filter: PR events → Code review destination
GitHub Source → Filter: issue events → Issue tracker destination

Payload Transformation

Transform webhooks for different destination formats:

Stripe Source → Transform: Slack format → Slack destination
Stripe Source → Transform: DB format → Database destination

Webhook Security

Enable verification where it exists

For a provider in the Yes column, set provider and signingSecret on the source and turn on rejectInvalidSignatures. That is what prevents unauthorized submissions, replay attacks and payload tampering.

For a provider in the No column, rejectInvalidSignatures would reject everything. Use an IP allowlist on the source and verify the signature in your own destination handler.

Secure Your Secrets

• Store webhook secrets in environment variables
• Rotate secrets periodically
• Use different secrets for each environment

Monitor Failed Verifications

Check the dashboard for failed signature verifications, which may indicate:

• Misconfigured secrets
• Attack attempts
• Provider changes

Provider-Specific Guides

Each provider guide includes:

• Step-by-step setup instructions
• Signature verification configuration
• Common event types and payloads
• Transform examples
• Troubleshooting tips

Select a provider from the sidebar to get started.