Webhooks Infrastructure

Webhooks look simple until you need retries, signing, replay, dead-letter, and per-customer endpoint management.

Sending webhooks (you → customers)

• ★ Svix — purpose-built webhooks-as-a-service: signing, retries, replays, customer-facing portal, OpenAPI definitions for events. Free open-source self-host (Svix Server) + hosted free tier. The default for "we send webhooks to our customers" use cases.
• Hookdeck — also offers outbound webhooks with retries, transforms, mocking.
• Roll-your-own — crypto.subtle for signing + a queue + retry/backoff. Fine for ≤ 5 endpoints.

Receiving webhooks (vendors → you)

• ★ Hookdeck — sit between vendor and your app: dedupe, retry, fan-out, traffic shaping, monitoring. Generous free tier.
• ★ Svix Operational Webhooks — same idea, Svix-flavored.
• Inngest — durable receivers; retries / replays as part of normal Inngest flows.
• QStash — event scheduling and webhook delivery; pay per message.
• Cloudflare Workers + Queues — DIY with full control.
• AWS API Gateway → SQS → Lambda — DIY enterprise pattern.

Local dev / tunnels

• ★ ngrok — the classic; free tier with a static domain on a paid plan.
• Cloudflare Tunnel (cloudflared) — free, no time limits, custom domains.
• localtunnel — simple OSS alternative.
• Tailscale Funnel — expose a local port on your tailnet to the public internet.
• Webhook.site — capture webhooks for inspection without coding.
• Smee.io (GitHub) — proxy webhooks to localhost for free.

Signing / verification

• HMAC-SHA256 with a per-customer secret is the de facto standard.
• @octokit/webhooks-methods — GitHub's webhook signature verification.
• stripe.webhooks.constructEvent — Stripe's helper.
• Svix Webhooks SDKs — verify Svix-signed payloads in any language.

Pick this if…

• You send webhooks to customers, want it solved: Svix.
• Inbound from many vendors, want one observability surface: Hookdeck.
• All-Cloudflare: Workers + Queues + Workflows.
• Local dev tunnel, default: Cloudflare Tunnel (free + no time limits) or ngrok.
• Just inspect a single webhook once: Webhook.site.