Infrastructure
Heroku Webhooks
Cloud application platform. Receive events for app releases, dyno state changes, and add-on updates.
Connecting Heroku to Hookbase
Create a source in Hookbase first — it gives you an ingest URL to paste into Heroku. Then:
- 1Install the Heroku CLI and log in (heroku login)
- 2Create the webhook: heroku webhooks:add -i api:release,api:build -l notify -u <your Hookbase ingest URL> -a <your-app>
- 3-l (level) is required: use notify for best-effort delivery, or sync to have Heroku retry failed deliveries
- 4Copy the Webhooks Signing Secret from the command output now (it's shown only once) and paste it into this source
- 5If you lose the secret, run heroku webhooks:update <id> --secret <new-value> -a <your-app> and update this source to match
Signature verification
Set the source's provider to heroku and paste the signing secret. Every request is checked before the event is stored, and anything that fails is rejected rather than quietly recorded.
- Algorithm
- HMAC-SHA256 (base64)
- Header
- Heroku-Webhook-Hmac-SHA256
- Where to find the secret
- Printed once by `heroku webhooks:add` (or returned by the Platform API create call) as the Webhooks Signing Secret. It can't be retrieved later. If you lose it, set a new one with `heroku webhooks:update --secret` and paste that here. Existing webhooks are listed in the Dashboard under App → More → View Webhooks.
Heroku event types
10 of the events people route most often. Hookbase accepts every event Heroku sends, whether or not it is listed here.
api:release
A new release was created
api:build
A build started or completed
api:app
An app was updated
api:dyno
A dyno state changed
api:formation
Dyno formation was changed (scaled)
api:addon
An add-on was provisioned or changed
api:domain
A custom domain was added or removed
api:addon-attachment
An add-on was attached to or detached from an app
api:collaborator
A collaborator was added, changed or removed
api:sni-endpoint
An SNI endpoint (SSL certificate) was added, changed or removed
What a Heroku webhook looks like
A api:release payload. Hookbase stores the raw body exactly as it arrived, so this is also what you get back on a replay.
{
"action": "create",
"actor": {
"email": "dev@example.com",
"id": "096370c8-f3ad-4e20-a309-fb4f06ec0a89"
},
"created_at": "2024-01-15T10:30:00Z",
"id": "b2a1c3d4-5e6f-4a7b-8c9d-0e1f2a3b4c5d",
"data": {
"id": "a7c1e9f2-3b4d-4c5e-8f6a-7b8c9d0e1f2a",
"version": 42,
"description": "Deploy abc123de",
"status": "succeeded",
"current": true,
"app": {
"id": "d4714cc8-aa56-4314-817c-0c6a66ff3d41",
"name": "my-api-prod"
},
"user": {
"email": "dev@example.com",
"id": "096370c8-f3ad-4e20-a309-fb4f06ec0a89"
},
"created_at": "2024-01-15T10:30:00Z",
"updated_at": "2024-01-15T10:30:00Z"
},
"previous_data": {},
"published_at": null,
"resource": "release",
"sequence": null,
"updated_at": "2024-01-15T10:30:00Z",
"version": "application/vnd.heroku+json; version=3",
"webhook_metadata": {
"attempt": {
"id": "8a44f820-2354-489d-9a11-a793cbf49979"
},
"delivery": {
"id": "d244009a-670f-4340-88e9-789a4f9002d5"
},
"event": {
"id": "b2a1c3d4-5e6f-4a7b-8c9d-0e1f2a3b4c5d",
"include": "api:release"
},
"webhook": {
"id": "01234567-89ab-cdef-0123-456789abcdef"
}
}
}Start receiving Heroku webhooks
Create a source, paste the URL into Heroku, and watch the first event arrive. The free tier includes 1,000 events a month.
Get Started Free