Webhooks that ship inside your app.
Hookline is a library you add to your codebase. It writes events in the same transaction as your data, signs them, retries them and delivers them from your own servers. There's no webhook service to run and no per-message bill.
Enqueue in the same transaction as your data.
Hookline adds an outbox table to the database you already run. Events commit or roll back with the order, invoice or user they describe, so you never announce something that didn't happen, or miss something that did.
await db.transaction(async (tx) => { const order = await tx.orders.insert(input) await hooks.send(tx, "order.paid", order) }) // both commit, or neither does
- Postgres, MySQL and SQLite
- Node.js, with pg, Knex, Kysely, Drizzle or Prisma
- An idempotency key on every event
Delivery that survives bad endpoints.
Workers run in the processes you already deploy, or on their own. Every attempt is signed, timed and recorded. Failing endpoints back off, trip a circuit breaker, and get replayed when they recover.
- Exponential, linear or custom retries with jitter
- Circuit breaker with half-open probes
- Auto-disable, then re-enable on recovery
- Rate and concurrency limits per endpoint
- Ordered delivery per key, when you need it
- Fan-out with topic and payload filters
- Batches and digests
- Dead letters with one-click replay
- SQS, EventBridge, Pub/Sub, Kafka and more
An inbox for the webhooks you receive.
Point Stripe, GitHub or Shopify at a route in your app. Hookline checks the signature, drops duplicates, stores the event and answers 200 straight away, then runs your handler with retries.
app.post("/hooks/stripe", hooks.inbox("stripe", async (event) => { await fulfil(event.data.object) })) // retried for you if this throws
- Signature presets for 25 providers, plus any HMAC scheme
- Duplicate detection on event IDs
- Replay anything you received, by time range
A portal your customers can actually use.
Drop a delivery log, endpoint settings, test sends and secret rotation into your own dashboard. It's a component you render, styled to match your app and served from your domain.
- One web component for React, Vue or plain HTML
- OpenTelemetry traces and Prometheus metrics
- Alerts when an endpoint starts failing
Signed, checked, and kept on your servers.
Payloads follow the Standard Webhooks spec, signed with HMAC-SHA256 or Ed25519. Secrets rotate with an overlap window, and every outbound request goes through an SSRF guard. Nothing passes through a third party.
- Standard Webhooks signatures
- Secret rotation without downtime
- SSRF guard with DNS pinning
- mTLS, bearer and basic auth
- Secrets encrypted at rest
- Audit log of endpoint changes
Everything in the box.
Every feature below is in Core: free, MIT licensed, no limits. The ones marked new are things we haven't seen in other open-source webhook tools.
Writing events
- Same-transaction outbox on your own database new
- Idempotency keys and duplicate suppression
- Event catalog with JSON Schema validation
- Version pinning per endpoint, with payloads converted for older versions new
- Thin or full payloads
- Scheduled and delayed sends
Delivery
- Exponential, linear or custom retry schedules
- Circuit breaker with half-open probes
- Auto-disable and recovery for failing endpoints
- Rate and concurrency limits per endpoint
- Ordered delivery per key new
- Batches and digests new
- Fan-out, topics and payload filters
- Declarative payload transforms: pick, omit, rename
Destinations
- HTTP webhooks
- AWS SQS, SNS, EventBridge and S3
- Google Pub/Sub and Azure Service Bus
- Kafka, RabbitMQ and NATS
- Your own destinations, as a plugin
Receiving
- Inbox with provider signature presets new
- Duplicate detection on event IDs
- Store first, answer 200, then process
- Handler retries with dead letters
- Replay received events by time range
- Generic Standard Webhooks verifier
Security
- Standard Webhooks signing, HMAC-SHA256 or Ed25519
- Overlapping secret rotation
- SSRF guard with DNS pinning
- Static IPs through your own proxy or NAT
- mTLS, bearer, basic auth and custom headers
- Per-endpoint field removal and encryption at rest new
- Endpoint ownership check on create
Operations
- Embeddable customer portal and a CLI
- CLI to tail, inspect and replay
- OpenTelemetry, Prometheus and structured logs
- Alerts when endpoints fail or get disabled
- Retention and pruning policies
- Chaos mode for staging: inject failures and latency new
- AsyncAPI docs generated from your catalog new
Why a library, not another server.
Open-source webhook servers are good software. They are also one more service to deploy, scale, upgrade and page someone about.
| Build it yourself | Run a webhook server | Hookline | |
|---|---|---|---|
| New service to deploy and scale | No | Yes: API, workers, queue | No, it runs in your app |
| Events committed with your data | Only if you build an outbox | No, sending is a network call | Yes, same transaction |
| Retries, circuit breaking, rate limits | You build them | Yes | Yes |
| Receiving webhooks too | You build it | Some do | Yes, the inbox |
| Customer portal | You build it | Separate app or iframe | A component in your app |
| Where payloads live | Your servers | Your servers | Your servers and database |
| What it costs | Weeks of engineering | Servers and on-call | Nothing. MIT licensed |
Free. All of it.
- CoreFreeEverything on this page: outbox, inbox, portal, destinations and the CLI. MIT licensed, no limits, no account.
- ProComing soonWhatever we'd have put here is already in Core. Don't wait up.
- DonateThanksIf Hookline saves you a few weeks of work, chip in and keep it free for the next team.
Stop rebuilding webhooks.
Install it in a minute. Everything is included: no account, no card, no upgrade later.