Inbound webhook reliability and payload routing

A curated, fact-checked directory of 19 tools and frameworks for receiving, queuing, retrying, verifying, transforming, routing and observing inbound webhooks — including the event layer in front of AI agents. Built for software vendors and single-family-office technology teams evaluating webhook infrastructure.

19 listings
14 open source or open core
7 capabilities compared
Verified 2026-10-19

Quick picks

Managed inbound gateway: Hookdeck Event Gateway, Svix Ingest.
Self-hosted gateway: Convoy, Svix (MIT server), WebhookX.
Webhooks that start durable workflows / AI agents: Inngest, Trigger.dev, Hatchet.
Serverless queue in front of a function: Upstash QStash, Amazon EventBridge.
Local testing & inspection: ngrok, Webhook.site, smee.io.
No/low-code routing: n8n, Webhooks by Zapier, Pipedream, Windmill.
Sending webhooks to your customers (adjacent): Svix Dispatch, Hook0, Hookdeck Outpost.

Comparison table

✔ = documented by the vendor · ✕ = not offered / vendor says no · ? = not verified. GitHub stars as of 2026-10-19.

Inbound webhook reliability and payload routing: capability and pricing comparison (19 tools)
Tool	Type	GitHub ★	Retries	Signature verification	Fan-out / routing	Transformation	Replay	Observability	Agent / LLM integration	Paid plans (as stated)
Hookdeck Event Gateway	SaaS	365	✔	✔	✔	✔	✔	✔	✔	Team from $39/month (pay-as-you-go events); Growth from $499/month; Enterprise custom
Svix (Ingest + Dispatch)	Both	3,453	✔	✔	✔	✔	✔	✔	?	Basic from $20/month; Professional from $490/month; Enterprise custom
Convoy	Both	2,880	✔	?	?	✔	?	✔	?	Premium $999/month (self-hosted); Enterprise contact sales
WebhookX	Open source	300	✔	✔	✔	✔	?	?	?	unknown (commercial license pricing not published)
Upstash QStash	SaaS	270	✔	?	✔	?	?	✔	?	Pay-as-you-go $1 per 100K messages; Fixed 1M $180/month; Fixed 10M $420/month; Enterprise custom
Amazon EventBridge	SaaS	—	✔	?	✔	✔	✔	?	?	No minimum; e.g. classic custom events $1.00 per million; API destinations $0.20 per million; Pipes $0.40 per million requests (as stated in examples)
Inngest	Both	5,959	✔	✕	?	✔	?	✔	✔	Pro from $99/month; Business from $499/month; Enterprise custom
Trigger.dev	Both	16,570	✔	✔	?	?	?	✔	✔	Hobby $10/month; Pro $50/month; Enterprise custom
Hatchet	Both	8,139	✔	✔	?	?	?	✔	✔	Pay-as-you-go: $30 per million runs, $5 per million events after free tier; custom plans for 100M+ runs
ngrok	SaaS	880	?	✔	?	?	✔	✔	✔	Hobbyist $10/month; Pay-as-you-go $20/month + usage; Enterprise custom
Webhook.site	Both	6,775	?	?	?	✔	✔	✔	?	Basic $9/month; Pro $19/month; Enterprise $69/month (USD, excl. VAT)
smee.io	Both	561	✕	✕	✕	✕	?	?	✕	Free
n8n	Both	207,961	?	?	✔	✔	?	✔	✔	Starter €20/month billed annually (2.5K executions); Pro €50/month billed annually; Business €667/month billed annually
Webhooks by Zapier	SaaS	—	?	?	?	✔	✔	?	✔	Professional from $19.99/month; Team from $69/month
Pipedream	Both	11,752	?	?	?	?	?	?	✔	Startup $99/month billed annually ($150 monthly); Business custom
Windmill	Both	18,219	?	✔	?	✔	?	✔	?	Enterprise listed 'from $120/mo' (seat-based)
Hook0	Both	1,499	✔	✔	✔	?	?	✔	?	Startup €59/month; Pro €190/month; dedicated on-prem Pro €1,000 setup + €500/month
Hookdeck Outpost	Both	1,067	?	?	✔	?	?	✔	?	Starter $10 per million events; Growth from $499/month + $10 per million events; Enterprise custom
Standard Webhooks	Open source	1,776	✕	✔	✕	✕	✕	✕	✕	Free

Download the dataset: JSON · CSV

Get featured — USD 500/month

Put your product at the top of this category, in front of software vendors and family-office technology buyers evaluating webhook infrastructure. Featured listings include a highlighted card, priority placement in the comparison table, and inclusion in our llms.txt summary read by AI assistants.

Top-of-category placement
Verified-vendor badge and extended description
Monthly, cancel anytime

USD 500/month

Get featuredBilled by AI FUTURE ASIA PTE LTD, Singapore. Editorial facts stay independent of payment.

All listings

Hookdeck Event Gateway

SaaS

Managed event gateway for receiving, verifying, queueing, filtering, transforming and routing inbound webhooks, with full request/event/attempt logs.

Website: https://hookdeck.com
Source: hookdeck/hookdeck-cli · ★ 365 (as of 2026-10-19) — Stars are for the open-source CLI (Apache-2.0); the gateway itself is SaaS.
License: Apache-2.0 (CLI only)
Free tier: Yes: Developer plan $0/month, 10,000 events, 3-day retention, 1 user
Paid plans: Team from $39/month (pay-as-you-go events); Growth from $499/month; Enterprise custom
Pricing model: Base plan + metered events ($3.00 per 100k up to 5M/month, tiered down); retries included in event price
Best fit: Engineering teams consuming many third-party webhooks (Stripe, Shopify, GitHub, AI providers) who want a managed buffer in front of their app or agents.

Retries: yes
Signature verification: yes
Fan-out / routing: yes
Transformation: yes
Replay: yes
Observability: yes
Agent / LLM integration: yes

Details: Retries up to a week / 50 attempts; 180+ pre-configured Source Types with signature verification (incl. OpenAI, Claude, Gemini, ElevenLabs, Replicate); one Source fans out to many Connections; JS transformations; dedup; delivery rate limits and per-tenant delivery groups; Issues + Metrics (Datadog/New Relic/Prometheus export on Growth); destination timeouts up to 15 min for AI agents; MCP server and agent skills.

Verified 2026-10-19 from: hookdeck.com · hookdeck.com · api.github.com

Svix (Ingest + Dispatch)

Both

Webhooks platform: Svix Ingest for receiving webhooks at scale, Dispatch for sending, plus Play for testing; core server is open source.

Website: https://www.svix.com
Source: svix/svix-webhooks · ★ 3,453 (as of 2026-10-19)
License: MIT
Free tier: Yes: $0/month, up to 50k messages/month, 7-day retention, Ingest included
Paid plans: Basic from $20/month; Professional from $490/month; Enterprise custom
Pricing model: Base plan + $0.0001 per additional message; retries and filtered messages free; each 64 KiB chunk billed as one message
Best fit: SaaS vendors that both send webhooks to customers and receive third-party webhooks; teams wanting an MIT self-host option.

Retries: yes
Signature verification: yes
Fan-out / routing: yes
Transformation: yes
Replay: yes
Observability: yes
Agent / LLM integration: unknown

Details: Ingest: automatic and manual retries, built-in webhook verification, configurable throttling for spikes, JS filter/transform/route. Dispatch: consumer portal, signature libraries, OpenTelemetry streaming (Enterprise), FIFO and broker/object-storage endpoints on higher tiers. Steering member of Standard Webhooks.

Verified 2026-10-19 from: www.svix.com · www.svix.com · api.github.com

Convoy

Both

Cloud-native webhook gateway for sending outgoing and receiving incoming webhooks, self-hosted open source or Convoy Cloud.

Website: https://getconvoy.io
Source: frain-dev/convoy · ★ 2,880 (as of 2026-10-19)
License: Custom/other (GitHub reports NOASSERTION)
Free tier: Yes: Community edition, self-hosted, $0 forever; 14-day Premium trial (Cloud trial: 100 events/day)
Paid plans: Premium $999/month (self-hosted); Enterprise contact sales
Pricing model: Flat monthly price with throughput limits; no per-message metering
Best fit: Platform teams that must run webhook infrastructure inside their own cloud/on-prem for data control and compliance.

Retries: yes
Signature verification: unknown
Fan-out / routing: unknown
Transformation: yes
Replay: unknown
Observability: yes
Agent / LLM integration: unknown

Details: Incoming & outgoing webhooks, automatic retries, message broker support (Community); JS transformation, OpenTelemetry export, RBAC, endpoint circuit breaking, white-labelling (Premium).

Verified 2026-10-19 from: getconvoy.io · api.github.com

WebhookX

Open source

Open-source webhook gateway (Go) for receiving, validating, transforming and delivering events at scale, with plugins.

Website: https://webhookx.io
Source: webhookx-io/webhookx · ★ 300 (as of 2026-10-19)
License: Apache-2.0 (some features require a license)
Free tier: Yes: open source; free production licenses for eligible non-commercial use
Paid plans: unknown (commercial license pricing not published)
Pricing model: Open core with license-gated features
Best fit: Teams wanting a self-hosted, Kong-style gateway for webhooks.

Retries: yes
Signature verification: yes
Fan-out / routing: yes
Transformation: yes
Replay: unknown
Observability: unknown
Agent / LLM integration: unknown

Details: Automatic retries with configurable delays; fan-out by event type; rate limiting; JSON Schema event validation; hmac-auth/basic-auth/key-auth inbound plugins; JS function plugin for custom signature verification; WASM transforms; HMAC-signed outbound.

Verified 2026-10-19 from: raw.githubusercontent.com · api.github.com

Upstash QStash

SaaS

Serverless HTTP message queue and scheduler that durably delivers messages to your endpoints with retries, DLQ and URL-group fan-out.

Website: https://upstash.com/docs/qstash
Source: upstash/qstash-js · ★ 270 (as of 2026-10-19) — Stars are for the JS SDK (MIT); QStash itself is SaaS.
License: MIT (SDK)
Free tier: Yes: $0/month, 1,000 messages/day
Paid plans: Pay-as-you-go $1 per 100K messages; Fixed 1M $180/month; Fixed 10M $420/month; Enterprise custom
Pricing model: Per-message (PAYG) or fixed daily-capacity plans. Note: page header says retries are free, but its FAQ says each delivery attempt (incl. retries) is billed — confirm with vendor.
Best fit: Serverless/edge apps (Vercel, Cloudflare) that need to buffer an inbound webhook and re-deliver it reliably to a function.

Retries: yes
Signature verification: unknown
Fan-out / routing: yes
Transformation: unknown
Replay: unknown
Observability: yes
Agent / LLM integration: unknown

Details: DLQ (3 days–3 months by plan), URL groups/topics for fan-out, delays up to 1 year+, parallelism limits instead of RPS caps, Prometheus/Datadog via Prod Pack add-on.

Verified 2026-10-19 from: upstash.com · api.github.com

Amazon EventBridge

SaaS

AWS serverless event bus with partner event buses for SaaS events, API destinations for HTTP delivery, Pipes for filter/transform/enrich, and archive & replay.

Website: https://aws.amazon.com/eventbridge/
Source: —
License: Proprietary (AWS)
Free tier: Partial: AWS management events ingested free; Scheduler free tier 14M invocations/month; Schema Discovery 5M events/month free
Paid plans: No minimum; e.g. classic custom events $1.00 per million; API destinations $0.20 per million; Pipes $0.40 per million requests (as stated in examples)
Pricing model: Pure usage-based, billed per event / 64 KB chunk
Best fit: AWS-native organisations routing SaaS and internal events across accounts.

Retries: yes
Signature verification: unknown
Fan-out / routing: yes
Transformation: yes
Replay: yes
Observability: unknown
Agent / LLM integration: unknown

Details: Rules fan out to many targets; retry policies; JSONata transformation and schema validation on enhanced buses; Pipes filter/enrich; archive & replay; API destinations deliver to any HTTPS endpoint incl. via PrivateLink.

Verified 2026-10-19 from: aws.amazon.com

Inngest

Both

Durable workflow/agent orchestration platform that can receive provider webhooks directly, transform them into events and start durable functions.

Website: https://www.inngest.com
Source: inngest/inngest · ★ 5,959 (as of 2026-10-19)
License: Custom/other (GitHub reports NOASSERTION)
Free tier: Yes: $0/month, 50k executions, 500k events ingested
Paid plans: Pro from $99/month; Business from $499/month; Enterprise custom
Pricing model: Plan + metered executions/events/concurrency; self-hosting available
Best fit: TypeScript/Python teams that want webhooks to directly trigger durable, retried workflows and AI agents without a webhook handler.

Retries: yes
Signature verification: no
Fan-out / routing: unknown
Transformation: yes
Replay: unknown
Observability: yes
Agent / LLM integration: yes

Details: Webhook URLs with server-side transforms, content-type support, request filtering and branch-environment routing. Docs state Inngest does NOT verify provider webhook signatures — your function must. Step-level retries, traces, durable agents.

Verified 2026-10-19 from: www.inngest.com · www.inngest.com · api.github.com

Trigger.dev

Both

Open-source platform for durable background tasks and AI agents; Webhooks (private beta) receive provider webhooks on hosted, verified endpoints and route them to tasks, agents and waiting runs.

Website: https://trigger.dev
Source: triggerdotdev/trigger.dev · ★ 16,570 (as of 2026-10-19)
License: Apache-2.0
Free tier: Yes: $0/month with $5/month free credits, 20 concurrent runs
Paid plans: Hobby $10/month; Pro $50/month; Enterprise custom
Pricing model: Plan with included credits + per-second compute + $0.25 per 10,000 runs
Best fit: TypeScript teams running long-lived AI agents that must be woken by external events (Slack, Linear, Stripe, GitHub).

Retries: yes
Signature verification: yes
Fan-out / routing: unknown
Transformation: unknown
Replay: unknown
Observability: yes
Agent / LLM integration: yes

Details: Webhooks feature is private beta: hosted verified endpoints, sources & verification, filters, waiters, session routing to agents. Durable tasks with no timeouts, alerts, log retention by plan, Realtime streaming.

Verified 2026-10-19 from: trigger.dev · trigger.dev · api.github.com

Hatchet

Both

Open-source orchestration engine for background tasks, AI agents and durable workflows, with webhook endpoints that trigger runs.

Website: https://hatchet.run
Source: hatchet-dev/hatchet · ★ 8,139 (as of 2026-10-19)
License: MIT
Free tier: Yes: 1M runs and 1M events free every month
Paid plans: Pay-as-you-go: $30 per million runs, $5 per million events after free tier; custom plans for 100M+ runs
Pricing model: Usage-based; retries not billed
Best fit: Teams replacing Celery/Temporal who want webhooks to start durable, rate-limited agent workflows.

Retries: yes
Signature verification: yes
Fan-out / routing: unknown
Transformation: unknown
Replay: unknown
Observability: yes
Agent / LLM integration: yes

Details: Webhooks with basic auth, API key or HMAC validation (algorithm/encoding configurable) mapped to event keys via CEL; retry policies, rate limits, concurrency, idempotency; OpenTelemetry and Prometheus metrics.

Verified 2026-10-19 from: hatchet.run · docs.hatchet.run · api.github.com

ngrok

SaaS

Ingress/API gateway that gives local or private services public HTTPS endpoints, with traffic inspection, webhook replay and a verify-webhook traffic policy action.

Website: https://ngrok.com
Source: ngrok/ngrok-go · ★ 880 (as of 2026-10-19) — Stars are for the open-source Go SDK (MIT); the ngrok service is SaaS.
License: MIT (ngrok-go SDK)
Free tier: Yes: $0 with $5 one-time usage credit, 3 endpoints, 20k HTTP/S requests
Paid plans: Hobbyist $10/month; Pay-as-you-go $20/month + usage; Enterprise custom
Pricing model: Plan with included usage credit + metered requests/data transfer/endpoint hours
Best fit: Developers building and debugging webhook handlers locally; teams wanting edge signature verification before traffic reaches the app.

Retries: unknown
Signature verification: yes
Fan-out / routing: unknown
Transformation: unknown
Replay: yes
Observability: yes
Agent / LLM integration: yes

Details: Test webhooks on localhost; Traffic Inspector shows headers/body/response and lets you replay requests; verify-webhook Traffic Policy action validates provider signatures at the edge; AI Gateway and MCP connectivity listed in product nav. Not a durable queue.

Verified 2026-10-19 from: ngrok.com · ngrok.com · api.github.com

Webhook.site

Both

Instant unique URLs and email addresses to inspect, test, transform and forward webhooks; Custom Actions add workflows on every hit.

Website: https://webhook.site
Source: webhooksite/webhook.site · ★ 6,775 (as of 2026-10-19)
License: Custom/other (GitHub reports NOASSERTION)
Free tier: Yes: free URLs expire after 7 days and accept a limited number of requests
Paid plans: Basic $9/month; Pro $19/month; Enterprise $69/month (USD, excl. VAT)
Pricing model: Flat subscription, no per-execution fee
Best fit: Developers and QA testing webhook integrations; light production forwarding.

Retries: unknown
Signature verification: unknown
Fan-out / routing: unknown
Transformation: yes
Replay: yes
Observability: yes
Agent / LLM integration: unknown

Details: Real-time request inspector, Replay/Redirect/XHR actions, Custom Actions to transform and forward, CLI forwarding to localhost, CSV export, API. FAQ cites 400,000 monthly unique users (Nov 2025).

Verified 2026-10-19 from: docs.webhook.site · docs.webhook.site · api.github.com

smee.io

Both

Free webhook payload delivery service from the Probot team that proxies payloads to your locally running app over Server-Sent Events.

Website: https://smee.io
Source: probot/smee-client · ★ 561 (as of 2026-10-19) — Stars are for smee-client.
License: ISC (client)
Free tier: Yes: free hosted service
Paid plans: Free
Pricing model: Free
Best fit: Developers testing GitHub and other webhooks locally.

Retries: no
Signature verification: no
Fan-out / routing: no
Transformation: no
Replay: unknown
Observability: unknown
Agent / LLM integration: no

Details: Development-only localhost forwarding, popular with GitHub App/Probot developers.

Verified 2026-10-19 from: smee.io · api.github.com

n8n

Both

Fair-code workflow automation with Webhook and Respond to Webhook nodes plus native AI agent, MCP and LLM nodes.

Website: https://n8n.io
Source: n8n-io/n8n · ★ 207,961 (as of 2026-10-19)
License: Fair-code (GitHub reports NOASSERTION)
Free tier: Self-hosted community edition; cloud plans offer free trial
Paid plans: Starter €20/month billed annually (2.5K executions); Pro €50/month billed annually; Business €667/month billed annually
Pricing model: Per workflow execution, unlimited steps/users
Best fit: Technical ops teams building webhook-triggered AI automations, self-hosted or cloud.

Retries: unknown
Signature verification: unknown
Fan-out / routing: yes
Transformation: yes
Replay: unknown
Observability: yes
Agent / LLM integration: yes

Details: Webhook trigger node, Respond to Webhook, Switch/If routing, Code and AI Transform nodes, AI agents and MCP Server/Client nodes, insights on paid tiers.

Verified 2026-10-19 from: n8n.io · docs.n8n.io · api.github.com

Webhooks by Zapier

SaaS

Catch Hook / Catch Raw Hook triggers that give each Zap a unique URL to receive webhooks and route the payload into 9,000+ apps.

Website: https://zapier.com/apps/webhook/integrations
Source: —
License: Proprietary
Free tier: Plan-dependent: help center lists webhook triggers on Free, Professional, Team and Enterprise; pricing page lists 'Webhooks' as a Professional feature — confirm
Paid plans: Professional from $19.99/month; Team from $69/month
Pricing model: Per-plan task allowances
Best fit: Ops and no-code teams routing inbound webhooks into business apps.

Retries: unknown
Signature verification: unknown
Fan-out / routing: unknown
Transformation: yes
Replay: yes
Observability: unknown
Agent / LLM integration: yes

Details: Catch Raw Hook includes headers and unparsed body (max 2 MB); Autoreplay listed in plan features; multi-step Zaps transform/route data; Zapier MCP and Agents products.

Verified 2026-10-19 from: help.zapier.com · zapier.com

Pipedream

Both

Integration platform with 3,000+ connectors, prebuilt triggers and MCP servers for adding integrations and event triggers to apps and AI agents.

Website: https://pipedream.com
Source: PipedreamHQ/pipedream · ★ 11,752 (as of 2026-10-19) — Repo contains the open-source components/connectors.
License: Custom/other (GitHub reports NOASSERTION)
Free tier: Yes: $0, every feature in development (no production)
Paid plans: Startup $99/month billed annually ($150 monthly); Business custom
Pricing model: Plan + external users ($2 each over 100) + usage credits ($0.012 each over 10,000)
Best fit: Product teams embedding third-party integrations and event triggers into their own app or agent.

Retries: unknown
Signature verification: unknown
Fan-out / routing: unknown
Transformation: unknown
Replay: unknown
Observability: unknown
Agent / LLM integration: yes

Details: 10,000+ prebuilt tools and triggers; deployed triggers emit events; MCP servers and Connect proxy for agents; SOC 2 Type 2. Webhook-specific reliability features not verified.

Verified 2026-10-19 from: pipedream.com · api.github.com

Windmill

Both

Open-source developer platform that auto-generates webhook endpoints for every script and flow, turning scripts into webhooks, workflows and UIs.

Website: https://www.windmill.dev
Source: windmill-labs/windmill · ★ 18,219 (as of 2026-10-19)
License: Custom/other (GitHub reports NOASSERTION)
Free tier: Yes: open source, self-host, unlimited executions
Paid plans: Enterprise listed 'from $120/mo' (seat-based)
Pricing model: Free OSS + seat-based Enterprise (developers / operators)
Best fit: Internal-tools and platform teams wanting code-first webhook handlers without deploying services.

Retries: unknown
Signature verification: yes
Fan-out / routing: unknown
Transformation: yes
Replay: unknown
Observability: yes
Agent / LLM integration: unknown

Details: Async, sync and SSE webhook endpoints per script/flow; version-pinned flow webhooks; raw_string payload for DIY signature verification; multipart uploads; run history in Runs menu.

Verified 2026-10-19 from: www.windmill.dev · www.windmill.dev · api.github.com

Hook0

Both

Open-source (SSPL-1.0) webhook server and EU-hosted cloud for providing webhooks to your users, with retries, HMAC signing and delivery logs.

Website: https://www.hook0.com
Source: hook0/hook0 · ★ 1,499 (as of 2026-10-19)
License: SSPL-1.0 (per vendor pricing page)
Free tier: Yes: Developer plan free forever, up to 100 events/day, 7-day retention
Paid plans: Startup €59/month; Pro €190/month; dedicated on-prem Pro €1,000 setup + €500/month
Pricing model: Plan tiers with daily event quotas; overage billed per event (never blocked on paid plans); retries free
Best fit: EU-centric SaaS vendors that need to offer webhooks to customers with data sovereignty.

Retries: yes
Signature verification: yes
Fan-out / routing: yes
Transformation: unknown
Replay: unknown
Observability: yes
Agent / LLM integration: unknown

Details: Outbound-focused (sending). One event can trigger multiple subscriptions; free retries; HMAC signatures; delivery monitoring; EU hosting (France) by default; static source IPs on demand.

Verified 2026-10-19 from: www.hook0.com · www.hook0.com · api.github.com

Hookdeck Outpost

Both

Open-source outbound webhooks and event-destinations infrastructure from Hookdeck, self-hosted or managed.

Website: https://hookdeck.com/outpost
Source: hookdeck/outpost · ★ 1,067 (as of 2026-10-19)
License: Apache-2.0
Free tier: Yes: self-hosted always free; managed first 50k events free
Paid plans: Starter $10 per million events; Growth from $499/month + $10 per million events; Enterprise custom
Pricing model: Per-million events, plus Growth base fee
Best fit: SaaS vendors adding outbound webhooks/event destinations for their customers.

Retries: unknown
Signature verification: unknown
Fan-out / routing: yes
Transformation: unknown
Replay: unknown
Observability: yes
Agent / LLM integration: unknown

Details: Outbound/adjacent: event destinations, tenants, topics and filters, user portal, OpenTelemetry; multi-region (US, EU, Asia) on Growth.

Verified 2026-10-19 from: hookdeck.com · api.github.com

Standard Webhooks

Open source

Open specification and libraries for sending and verifying webhooks securely and consistently (signatures, timestamps, replay protection).

Website: https://www.standardwebhooks.com
Source: standard-webhooks/standard-webhooks · ★ 1,776 (as of 2026-10-19)
License: Apache-2.0
Free tier: Free (specification + libraries)
Paid plans: Free
Pricing model: Not applicable
Best fit: Any vendor emitting webhooks or engineer writing a verifier.

Retries: no
Signature verification: yes
Fan-out / routing: no
Transformation: no
Replay: no
Observability: no
Agent / LLM integration: no

Details: Spec covers security against SSRF, spoofing and replay attacks plus interoperability; steering committee includes engineers from Zapier, Twilio, Lob, Mux, ngrok, Supabase, Svix and Kong.

Verified 2026-10-19 from: www.standardwebhooks.com · api.github.com

Reference architecture: reliable inbound webhooks

Edge receive — a dedicated endpoint or gateway URL per provider; reject oversize payloads early.
Verify — HMAC signature over the raw body + timestamp tolerance (see Standard Webhooks).
Persist & ack — write the raw request to durable storage/queue, return 2xx within the provider's timeout.
Route & transform — filter by event type, fan out to destinations, reshape payloads (and trim them before LLM prompts).
Deliver with backpressure — rate/concurrency limits per destination and per tenant; exponential-backoff retries; dead-letter queue.
Process idempotently — dedupe on provider event ID; tolerate out-of-order delivery using payload timestamps.
Observe & replay — logs of every request/attempt, alerts on failure and backlog, replay after fixes.

For AI agents, add: long destination timeouts or accept-then-callback, durable orchestration for multi-step work (Inngest, Trigger.dev, Hatchet), and strict verification — an agent with tools turns a forged webhook into a real action.

FAQ

How do I make inbound webhooks reliable?

Treat every webhook as untrusted, at-least-once input. (1) Verify the signature and timestamp on the raw body before parsing. (2) Acknowledge fast with a 2xx and push the payload to a durable queue or gateway rather than doing work in the request. (3) Process idempotently using the provider's event ID so duplicates are harmless. (4) Retry failures with exponential backoff and send exhausted events to a dead-letter queue. (5) Keep the raw payloads so you can replay after a bug fix. (6) Alert on error rate, latency and backlog. Managed gateways such as Hookdeck, Svix Ingest or Convoy package most of these steps; queues such as Upstash QStash or Amazon EventBridge cover buffering and retries.

What is a webhook gateway and do I need one?

A webhook gateway is a service that sits between webhook senders and your application. It receives the HTTP request, verifies it, stores it durably, and delivers it to one or more destinations with retries, rate limits, filtering and logs. You likely need one when you consume webhooks from several providers, cannot afford to lose events during deploys or outages, or need to replay events after a bug.

How should I verify webhook signatures?

Compute an HMAC (usually SHA-256) over the exact raw request body (and timestamp, where the provider signs one) with your shared secret, compare it with the signature header in constant time, and reject requests whose timestamp is outside a small tolerance to block replay attacks. The Standard Webhooks specification documents a common scheme. Some gateways (Hookdeck Source Types, ngrok's verify-webhook action, Hatchet HMAC webhooks, WebhookX auth plugins) verify at the edge; note that Inngest's docs state it does not verify provider signatures, so your function must.

How do I trigger an AI agent from a webhook without hitting LLM rate limits or timeouts?

Put a queue or gateway in front of the agent. Filter out events the agent does not need, trim payloads before they reach the prompt, cap concurrent deliveries to stay within your model provider's limits, and give the destination a long enough timeout (Hookdeck allows up to 15 minutes). For multi-step or human-in-the-loop work, have the webhook start a durable run in an orchestrator such as Inngest, Trigger.dev or Hatchet, which retry each step independently.

Should I build my own webhook infrastructure or buy it?

Build if you receive low volumes from one or two providers: a verified endpoint that writes to a queue you already run (SQS, Redis, Postgres) is enough. Buy or self-host a gateway when you need multi-provider verification, replay, per-tenant rate limits, dashboards and alerting, or compliance artefacts (SOC 2, HIPAA). Open-source options (Svix, Convoy, Hook0, WebhookX, Hookdeck Outpost) let you self-host when data residency matters.

What is the difference between inbound and outbound webhook tools?

Inbound (receiving) tools accept webhooks from third parties and deliver them to your systems — e.g. Hookdeck Event Gateway, Svix Ingest, Convoy incoming, ngrok. Outbound (sending) tools help a SaaS vendor deliver webhooks to its own customers with signing, retries and a consumer portal — e.g. Svix Dispatch, Hook0, Hookdeck Outpost, Convoy outgoing. Several vendors offer both.

How do I test webhooks locally?

Expose your local server with a tunnel or forwarding CLI: ngrok (with traffic inspection and replay), the Hookdeck CLI, Webhook.site's CLI, or smee.io for GitHub-style development. Replay captured requests instead of re-triggering events at the provider.

How much does a managed webhook gateway cost?

Most have free tiers. As published on 2026-10-19: Hookdeck Team from $39/month and Growth from $499/month; Svix Basic from $20/month and Professional from $490/month; Convoy Premium $999/month self-hosted; Hook0 Startup €59/month; Upstash QStash pay-as-you-go $1 per 100K messages. Usage-based charges apply on most plans — check each vendor's pricing page.

Methodology

Every listing was checked against the vendor's own pricing page, documentation, or GitHub repository on 2026-10-19 (Asia/Singapore). Star counts come from the GitHub API on that date. Capabilities are marked ✔ only when documented; “?” means we could not verify it, not that it is missing. Pricing is quoted as published and may change — always confirm with the vendor. Featured placement never changes the facts shown. Corrections: email the publisher.