Google Cloud Pub/Sub

Each outbound message is published to your topic. The message data is the payload (UTF-8), and the signature attributes are Pub/Sub message attributes. Requires the Starter plan or above.

Settings

Field	Required	Notes
`projectId`	Yes	The topic's project
`topicId`	Yes	The topic id (not the full path)
`serviceAccountKey`	Yes	A service-account JSON key. Hookbase exchanges it for access tokens at `oauth2.googleapis.com`, and the key never leaves Hookbase. Only `serviceAccountEmail` is shown afterwards.

Permissions

Create a service account that can only publish to the one topic:

gcloud iam service-accounts create hookbase-publisher --project my-project
 
gcloud pubsub topics add-iam-policy-binding orders \
  --project my-project \
  --member "serviceAccount:hookbase-publisher@my-project.iam.gserviceaccount.com" \
  --role roles/pubsub.publisher
 
gcloud iam service-accounts keys create key.json \
  --iam-account hookbase-publisher@my-project.iam.gserviceaccount.com

Paste the contents of key.json into Service account key, then delete the local file.

Verifying in a subscriber

import { Webhook } from 'standardwebhooks';
const wh = new Webhook(process.env.HOOKBASE_SIGNING_SECRET);
 
subscription.on('message', (message) => {
  const event = wh.verify(message.data.toString('utf8'), message.attributes);
  // ...handle event
  message.ack();
});

PERMISSION_DENIED and NOT_FOUND are permanent: the message is dead-lettered at once. UNAVAILABLE, RESOURCE_EXHAUSTED and DEADLINE_EXCEEDED are retried.