Webhooker
Hookdeck Alternatives: EU-Hosted Webhook Gateways
Looking for a Hookdeck alternative because of data residency, pricing or inbound focus? Here's an honest selection framework and where EU-hosted options fit.
Blog
Webhook engineering, in the open.
Field notes on signature verification, idempotency, delivery guarantees, and running webhook infrastructure in the EU.
Webhook Pricing Models: Per-Event, Per-Seat, Self-Hosted
Per-event, per-seat, per-destination or self-hosted — each model breaks at a different point. Here's how to compare them, and why overage billing turns a traffic spike into an invoice.
Are Webhooks Personal Data? GDPR for Payloads with PII
Most webhook payloads carry an email, a name or an IP, which makes them personal data under GDPR. Here's what that means for your webhook layer: roles, retention, deletion and sub-processors.
Static Outbound IPs for Webhooks: Firewall Allowlisting
Some destinations only accept traffic from known IPs. Here's why cloud egress addresses drift, what a static outbound IP gives you, and why an allowlist is not a substitute for signatures.
FOR UPDATE SKIP LOCKED: Postgres as a Job Queue
You don't need Kafka for a job queue. How SELECT ... FOR UPDATE SKIP LOCKED turns a Postgres table into a durable queue many workers claim from safely — with the schema, bloat and locking details that matter.
Webhook Ordering: When You Need FIFO Delivery
Webhooks arrive out of order by default. When ordering actually matters, how FIFO delivery works, and what head-of-line blocking costs you.
At-Least-Once vs Exactly-Once Delivery in Webhooks
Webhook delivery guarantees compared: why exactly-once fails over HTTP, what at-least-once promises, and how idempotent consumers reach effectively-once.
How Do Webhooks Work? A Walkthrough of the Actual HTTP
Most explanations stop at "the provider sends you a POST". Here is the real request, header by header, what your 200 actually means, and what the sender does when you do not answer.
Where to Find Your Stripe Webhook Signing Secret
Your Stripe webhook signing secret lives in the Webhooks tab in Workbench, behind "Click to reveal". Here's the exact path, why the CLI gives you a different one, and why test and live never share a secret.
Webhook Signature Verification Failed: 6 Causes and Fixes
Six causes behind "No signatures found matching the expected signature for payload" and its equivalents: a parsed body, the wrong secret, hex vs base64, clock skew, a rewriting proxy, or test vs live keys.
Webhooks vs APIs: The Difference, and What It Costs You
An API gives you data when you ask. A webhook sends it when something happens. The real decision is not push versus pull, it is which side of the connection has to be reliable.
Webhook Replay Attacks: Why a Valid Signature Isn't Enough
A signature proves a webhook was genuine once. Without a timestamp check, a captured request stays valid forever. Here's how tolerance windows, clock skew and dedupe stop replays.
Webhook Security: Verifying Signatures, Stopping Replays, and Signing Outbound Requests
A public webhook endpoint accepts POSTs from anyone. This is the full security model: verify the provider's HMAC signature, reject replays with a timestamp window, and sign what you forward.
Shopify Webhooks: HMAC & GDPR Topics
Shopify's HMAC is base64, not hex, which trips up most integrations. Verify it correctly and handle the mandatory GDPR webhooks reliably.
Webhooker vs Svix vs Hookdeck (2026)
Svix, Hookdeck and Webhooker solve different problems: sending vs receiving webhooks, US vs EU hosting. A practical way to choose one in 2026.
Dead Letter Queues for Webhooks
When retries run out, a webhook shouldn't just vanish. A dead letter queue catches failed deliveries so you can inspect and replay them.
Idempotency Keys for Webhook Consumers
At-least-once delivery means your consumer sometimes sees the same event twice. How to dedupe with a stable event id, and how that differs from the Idempotency-Key header you send when calling an API.
Verifying GitHub Webhook Signatures
GitHub signs webhooks with X-Hub-Signature-256. Verify the HMAC against the raw body and handle redeliveries so you never process an event twice.
Build vs Buy Webhook Infrastructure
Rolling your own webhook receiver looks simple until verification, retries, idempotency and replay pile up. An honest build-vs-buy cost breakdown.
Webhook Retries: Exponential Backoff & Jitter
Naive retries hammer a destination that's already down. Retry webhooks properly instead: exponential backoff, jitter and a circuit breaker.
Verifying Stripe Webhook Signatures
Stripe signs webhooks with the Stripe-Signature header. How the signed payload is built, how to recompute the HMAC-SHA256 over the raw bytes, and how the timestamp tolerance stops replays.
EU-Hosted Webhook Infrastructure for GDPR
Webhooks routinely carry personal and payment data, and the gateway sees all of it. Here's why EU-only ingest, storage and delivery matter under GDPR.
What Is a Webhook Gateway — and When You Actually Need One
A webhook gateway sits between the apps that send you webhooks and your code — it verifies, stores, retries and replays every event, so a plain webhook receiver in your app never has to.
No articles match your search.