01 / Developer Documentation

Developer Documentation

Complete technical reference for ingesting, verifying, queuing, and recovering mission-critical webhooks with sub-millisecond overhead.

Architecture

1. System Architecture & Ingestion Pipeline

Hookbase acts as an authoritative, high-availability ingress proxy between upstream webhook publishers (Stripe, GitHub, Shopify, custom microservices) and your internal application endpoints.

Deterministic Ingestion SequenceAvg Latency: 2.4ms
Step 01

Ingress Gateway

TLS 1.3 termination, payload capture, instant 200 OK ACK.

Step 02

Redis BullMQ

Buffered in persistent memory queues to absorb concurrency surges.

Step 03

Dual HMAC Verifier

Cryptographic signature computed & matched against secret.

Step 04

Target / DLQ

Dispatched downstream or isolated in DLQ on exhaustion.

Quickstart

2. 3-Minute Quickstart Setup

Set up an inbound webhook endpoint in under three minutes and inspect requests in real time.

1

Create an Inbound Source Endpoint

Navigate to your Hookbase Dashboard > Sources > Create Source. You will receive a unique ingestion URL:

https://api.hookbase.dev/v1/ingest/src_90bca23f4e19
2

Send a Test Webhook Payload

Fire a mock event from your terminal using cURL:

cURL Test Command
curl -X POST https://api.hookbase.dev/v1/ingest/src_90bca23f4e19 \
  -H "Content-Type: application/json" \
  -d '{"event":"order.completed","amount":9900,"currency":"usd"}'
3

Inspect Real-Time Logs

Your request appears immediately in your dashboard under Live Requests with its complete JSON body, parsed HTTP headers, remote IP, and sub-millisecond execution trace.

Security

3. Cryptographic HMAC Verification

Never trust unverified inbound payloads. Hookbase calculates and matches HMAC-SHA256 signatures before forwarding payloads to downstream microservices.

curl -X POST https://api.hookbase.dev/v1/ingest/src_live \
  -H "Content-Type: application/json" \
  -H "x-hookbase-signature: sha256=9f4bcd2e41a788c0349281a943fe091c8901235b" \
  -d '{"event":"charge.succeeded","amount":14900}'
Supported Upstream Signature Algorithms

Hookbase natively decodes and auto-matches signatures for Stripe (`Stripe-Signature`), Shopify (`X-Shopify-Hmac-SHA256`), GitHub (`X-Hub-Signature-256`), and standard generic HMAC headers.

Resilience

4. Exponential Retries & Dead Letter Queue

When downstream services throw 500s or time out, Hookbase avoids cascading server crashes by buffering delivery attempts with randomized jitter.

Standard Automated Retry Policy
Attempt 1 (Immediate)0ms delay on failure
Attempt 2 (+15 seconds)Exponential backoff + jitter (+/- 2s)
Attempt 3 (+2 minutes)Downstream cooldown buffer
Attempt 4 (+15 minutes)Microservice restart allowance
Attempt 5 (DLQ Quarantine)Hard isolation • Alert sent
Tooling

5. Hookbase CLI & Local Tunneling

Debug webhooks on your local workstation without configuring third-party port tunnels like ngrok.

Terminal Forwarding Workflow
# 1. Log in to your Hookbase account
hookbase auth login

# 2. Forward live inbound traffic to local dev server
hookbase listen --source src_90bca23f --forward-to localhost:3000/api/webhook

# Terminal Output:
# [22:30:14] Stripe  charge.succeeded -> http://localhost:3000 [200 OK • 22ms]
# [22:30:19] GitHub  push             -> http://localhost:3000 [200 OK • 18ms]
Integrations

6. Dokploy & Private Infrastructure Sync

Hookbase integrates natively with Dokploy servers to trigger automated re-deploys upon validated git push webhooks.

Deploy Webhook Gateway Route

Use your sovereign Hookbase gateway endpoint as the CI/CD webhook destination:

POST https://api.hookbase.dev/deploy/:connectionId/:applicationId

Hookbase inspects the git push branch (`refs/heads/main`), authenticates against your Dokploy tRPC instance, and triggers an atomic container rebuild with real-time logs.

REST API

7. Ingestion Gateway REST API

All platform capabilities are exposed via deterministic RESTful endpoints authenticated via API bearer tokens.

POST/v1/ingest/:sourceId
Public ingestion gateway endpoint
GET/v1/requests
List historical captured webhooks with filters
POST/v1/replay/:requestId
Replay a historical request to a destination
GET/v1/dlq
List quarantined dead letter requests