Frequently Asked Questions

Quick answers to common questions about Hookbase.

Getting Started

What is Hookbase?

Hookbase is a webhook routing and delivery platform. It receives webhooks from any provider, transforms payloads, applies filters, and reliably delivers them to one or more destinations with automatic retries.

How do I receive my first webhook?

1. Create a source with your provider type (e.g., Stripe, GitHub)
2. Create a destination pointing to your application URL
3. Create a route connecting the source to the destination
4. Configure the webhook URL shown on your source in your provider's dashboard

See the Quick Start guide for a complete walkthrough.

What providers does Hookbase support?

Hookbase has built-in signature verification for 17+ providers including Stripe, GitHub, Shopify, Slack, Twilio, and more. You can also use Custom Webhooks for any provider not on the list.

See the full list on the Integrations overview.

Can I test webhooks locally during development?

Yes. Use Hookbase Tunnels to forward webhooks to your local machine via a secure WebSocket connection. Install the CLI and run hookbase tunnel to get started.

Sources & Destinations

What is the difference between a source and a destination?

A source is where webhooks come in — it's the URL you give to your webhook provider. A destination is where webhooks go out — your application endpoint that processes the webhook.

Can one source send to multiple destinations?

Yes. Create multiple routes from the same source, each pointing to a different destination. You can apply different transforms and filters to each route.

Can multiple sources send to the same destination?

Yes. Multiple routes from different sources can all target the same destination. This is useful for consolidating webhooks from several providers into one handler.

What destination types are supported?

• HTTP/HTTPS URLs — any publicly accessible endpoint
• Hookbase Tunnels — for local development
• Batch destinations — aggregate events and deliver on a schedule

How do I handle provider-specific webhook URLs?

Each source generates a unique ingestion URL in the format:

https://api.hookbase.app/ingest/{orgSlug}/{sourceSlug}

Copy this URL into your provider's webhook configuration panel.

Transforms & Filters

What is a transform?

A transform modifies the webhook payload before delivery using JSONata expressions. Use transforms to reshape data, extract fields, or enrich payloads.

What is a filter?

A filter evaluates conditions to decide whether a webhook should be delivered. Filters use JSONata expressions that return true (deliver) or false (skip).

Can I chain multiple transforms?

Yes. Attach multiple transforms to a route — they execute in order. Each transform receives the output of the previous one.

What expression language do transforms and filters use?

Hookbase uses JSONata, a lightweight query and transformation language for JSON. It supports field access, string manipulation, math, array operations, conditionals, and custom functions.

How do I test a transform before deploying it?

Use the API Explorer or the dashboard's transform editor which includes a live preview. You can also test expressions at try.jsonata.org.

Delivery & Retries

What happens if my destination is down?

Hookbase automatically retries failed deliveries using exponential backoff. The retry schedule depends on your plan:

Plan	Max Retries	Backoff
Free	3	Up to 1 hour
Starter	5	Up to 4 hours
Pro	8	Up to 12 hours
Business	12	Up to 24 hours

See Plans & Limits for full details.

What counts as a failed delivery?

Any non-2xx HTTP response (or a connection timeout) counts as a failure. Hookbase records the response status and body for debugging.

Can I manually retry a failed delivery?

Yes. Use the dashboard or the Deliveries API to retry any delivery:

curl -X POST https://api.hookbase.app/api/organizations/{orgId}/deliveries/{dlv_id}/retry \
  -H "Authorization: Bearer whr_your_api_key"

What is the delivery timeout?

Hookbase waits up to 30 seconds for your destination to respond. If the timeout is exceeded, the delivery is marked as failed and retried according to your plan's retry schedule.

What is the dead letter queue (DLQ)?

After all retry attempts are exhausted, failed deliveries move to the dead letter queue. You can inspect and manually retry DLQ items from the dashboard or API.

Does Hookbase deduplicate webhooks?

Yes. Enable deduplication on a source to automatically detect and skip duplicate events based on provider event IDs or payload hashing.

Security

Are webhook signatures verified?

Yes. When you configure a source with a provider type and signing secret, Hookbase automatically verifies the signature on every incoming webhook. Invalid signatures are rejected with a 401 response (unless you disable rejectInvalidSignatures).

Is webhook data encrypted?

All data is encrypted in transit (TLS) and at rest. For additional security, you can enable field-level encryption to encrypt specific payload fields with your own keys.

Can I restrict which IPs can send webhooks?

Yes. Configure IP filtering on any source to allowlist or blocklist specific IP addresses or CIDR ranges.

Does Hookbase support custom domains?

Yes. You can use your own domain (e.g., webhooks.yourcompany.com) instead of the default api.hookbase.app/ingest/... URL. See the Custom Domains guide.

How are API keys managed?

API keys use the whr_ prefix and are stored as SHA-256 hashes. You can create, rotate, and revoke keys from the dashboard or API Keys API. See Authentication for details.

Billing & Plans

What plans are available?

Hookbase offers four plans: Free, Starter, Pro, and Business. Each plan has different limits for events, sources, destinations, and retention. See Plans & Limits for a comparison.

What happens if I exceed my plan limits?

You'll receive a notification when approaching your limits. Once exceeded, new events may be rejected until you upgrade or the next billing period begins.

Can I change plans at any time?

Yes. Upgrade or downgrade from the dashboard at any time. Upgrades take effect immediately; downgrades apply at the end of the current billing period.

Troubleshooting

My webhooks aren't arriving — what should I check?

1. Verify the webhook URL is correct in your provider's dashboard
2. Check the source's event log for incoming events
3. Ensure a route connects your source to the destination
4. Check the delivery log for error details
5. Verify your destination is reachable and returning 2xx responses

See the Troubleshooting guide for more scenarios.

I'm getting 401 errors on incoming webhooks

This usually means signature verification is failing. Double-check that the signing secret in Hookbase matches the one configured in your provider. See the integration page for your specific provider.

Deliveries are timing out

Ensure your destination responds within 30 seconds. If processing takes longer, accept the webhook with a 200 response and handle it asynchronously.

---

Can't find what you're looking for? Check the full documentation or reach out to support.