Trusted by teams at
One POST from your backend. Hook0 does the HMAC, the retries, the DLQ and the delivery logs. SDKs in Python and Node.js. Open-source, free tier, no credit card.
100 events/day free. No credit card. Open-source.
Trusted by teams at
One endpoint, one payload. No SDK required, no webhook concepts to learn first.
POST https://api.hook0.com/api/v1/event
Authorization: Bearer <APPLICATION_AUTH_TOKEN>
Content-Type: application/json
{
"application_id": "c0ea6ffa-1972-4435-b434-ec9e93d38f42",
"event_type": "invoice.paid",
"event_id": "evt_Wqb1k73rXprtTm7Qdlr38G",
"payload": {
"invoice_id": "in_8X9aBcDeFgHiJk",
"status": "paid",
"amount_eur": 4990
},
"labels": { "tenant": "acme", "env": "prod" }
}
hook0 = Hook0("AUTH_TOKEN")
hook0.message.create(
"app_id",
MessageIn(
event_type="invoice.paid",
event_id="evt_123",
payload={"status": "paid"}
)
)const hook0 = Hook0("AUTH_TOKEN");
await hook0.message.create("app_id", {
event_type: "invoice.paid",
event_id: "evt_123",
payload: { status: "paid" }
});Payloads carry a signature and a timestamp. Subscribers verify both. Replay attacks fail the timestamp check.
Fast retries within the first few minutes for flaky endpoints. Slow retries over hours and days for real outages. DLQ when the budget runs out.
Pass your own event_id. Hook0 deduplicates on it, so the API call is safe to retry without firing twice downstream.
Headers, body, response code, latency. Stored per attempt. Replay any event by ID, from the dashboard or the API.
Python and Node.js. Generated from the OpenAPI spec, so the client and the API stay in sync.
100 events per day, no credit card. Paid plans scale volume. Every feature on this page is in the free tier.
The Hook0 webhook API is a REST interface that lets your backend trigger an event with a single HTTP call. Hook0 then signs the payload with HMAC, delivers it to every matching subscriber, retries on failure with a configurable two-phase backoff, and logs every attempt. SDKs are available for Python, Node.js and other languages.
Authentication uses a Bearer token (application authentication token) passed in the Authorization header. Tokens are scoped to an application and can be rotated from the dashboard at any time.
Yes. Every event triggered via the webhook API is automatically signed with HMAC (so subscribers can verify it) and retried using a two-phase backoff strategy on delivery failure. Dead letter queues capture events that exhaust their retry budget.
Official SDKs include Python and Node.js, with community libraries available for more languages. The REST API is fully documented in the API reference, so any HTTP client works.
Yes. Rate limits scale with the plan: the free tier allows 100 events per day, paid tiers raise both the daily volume and the burst rate. Self-hosted deployments are not rate-limited by Hook0.
Stop building webhook infrastructure. Start shipping features. Get started in minutes.