Hookway

Receive, verify, and route webhooks to the systems you already run. Expose selected APIs as authenticated MCP tools, configured in the same YAML flows. Hookway is self-hosted: configure flows in YAML or export them from the visual builder, then run core as a Go binary or Docker container.

Features

• Verify senders: HMAC and ECDSA signatures, HTTP Basic, exact tokens, and JWT. Verify the original request before business transforms.
• Control traffic: in-flight limits, IP allowlists, loop detection, rate limits, and duplicate protection. Use memory for one process or Redis/PostgreSQL to share rate limits and duplicate reservations across replicas.
• Read events and files: JSON, ordered XML, multipart uploads, and raw bodies.
• Validate and transform: JSON Schema checks, explicit type conversions, field mapping, JSON change detection, XML edits, and sandboxed JavaScript.
• Create named events: share JSON payload contracts across flows and construct validated events with IDs and timestamps before delivery.
• Choose delivery paths: filters, if/else, switches, dynamic environment routing, named HTTP/PostgreSQL/DynamoDB lookups, and bounded batch processing.
• Publish directly: RabbitMQ, SQS, SNS, Kafka, Redis streams/lists/Pub/Sub/key-value, PostgreSQL, MongoDB, S3, Lambda, HTTP webhooks, and Temporal workflow starts. Store decoded upload bytes in S3 or Redis key/value storage.
• Call HTTP APIs: forward requests, manage outbound credentials, and return upstream responses to the caller.
• Spot-check webhooks: Sample → Inspect on an observation branch captures current bodies and context for view-only records while every webhook continues to Publish. Download captured files from the console; uploads share replay retention and limits.
• Recover failures: optional replay service and console to inspect, download, retry, dismiss, or investigate missed deliveries after the sender got a success response. Recovery is operator initiated; capture is best effort.
• Monitor operations: Prometheus metrics, Grafana dashboards, health/readiness probes, and graceful shutdown.
• Author visually: a browser builder with Go/WASM validation and YAML export. It creates configuration; it does not manage a running server.

Your applications own queue consumption and business processing. A successful response means the acknowledgement policy you configured, not exactly-once processing. Async HTTP delivery uses a process-local memory queue.

Website · First signed webhook · API-to-MCP guide

Quick start

With Docker and Docker Compose installed:

make dev-up

Open the replay console or builder. The local development guide has the sign-in key, a signed webhook example, and a failure/retry walkthrough.

For a minimal core configuration, start with examples/config.yaml. See all examples, configuration, and CLI commands.

How it fits together

flowchart LR
  Sender[Webhook sender] --> Core[Hookway core]
  Builder[Optional config builder] -. exports .-> Config[core.yaml]
  Config -. configures .-> Core
  Core <--> Protection[Rate limits and duplicate protection]
  Protection --> Memory[(Per-process memory)]
  Protection --> Shared[(Shared Redis or PostgreSQL)]
  Core --> Destinations[Queues, stores, databases, Lambda, workflows, or HTTP]
  Core -. captures eligible failures .-> Replay[Optional replay service]
  Replay <--> ReplayDB[(Replay PostgreSQL)]
  Replay -. operator retry .-> Core

Protection uses the store selected in YAML. Replay has its own PostgreSQL store. Flows are typed node graphs; see pipeline invariants for ordering rules and recovery limits.

Learn more

• Documentation: references, feature guides, and operations.
• Docker images: core, replay, and frontend packaging.
• Security and vulnerability reporting.
• Contributing and extending Hookway.