Railhook

Open-source webhook gateway. Send webhooks to your customers and receive them from Stripe, GitHub and others, with retries, signatures and a record of every attempt. Self-hosted or in Railhook Cloud.

Website · Docs · API reference · Railhook Cloud · Changelog

Install

With Docker and Compose (about 4 GiB of RAM):

curl -fsSL https://railhook.io/install.sh | bash
# on a server with a domain, with HTTPS:
curl -fsSL https://railhook.io/install.sh | bash -s -- --domain hooks.example.com --email ops@example.com

The installer checks the machine, generates the secrets into .env, pins the latest release, starts the stack and adds a ./railhook helper (status, logs, upgrade, backup, doctor). To do the same by hand with docker compose, or to install on Kubernetes with the Helm chart, see Install with Docker and Kubernetes.

Send an event

Create a project, an endpoint and an API key in the dashboard, then:

curl -X POST http://localhost:8080/api/v1/events \
  -H "X-API-Key: $RAILHOOK_API_KEY" \
  -H "Idempotency-Key: order-12345-completed" \
  -H "Content-Type: application/json" \
  -d '{"type":"order.completed","data":{"orderId":"ord_12345"}}'

Railhook signs it and delivers it to every endpoint subscribed to order.completed.

What it does

• Sends each event to every endpoint subscribed to its type. The event is stored in the same transaction as the API call; the worker claims it from Postgres and delivers it.
• Retries a failed delivery after 1m, 5m, 15m, 1h, 6h and 24h (7 attempts). What still fails goes to Failed Messages for bulk retry.
• Signs every request with HMAC-SHA256 in Standard Webhooks headers. A rotated secret keeps signing alongside the new one for 24 hours.
• Deduplicates on Idempotency-Key: a repeated key returns the first event instead of a new one.
• Optional per-endpoint ordering, rate limits and a circuit breaker.
• Customer portal: embed a page where your customers add endpoints, pick event types, and see and retry their deliveries.
• Replay: resend one delivery, or replay a time range of events as new deliveries.
• Incoming webhooks: one URL per source, signature verified (Stripe, GitHub, GitLab, Shopify, Slack, Twilio, Square, Adyen, SendGrid, HubSpot, or generic HMAC), raw request stored, then forwarded to your destinations with retries after 1m, 5m, 15m and 1h (5 attempts).
• Every attempt is recorded with its request, response and timing.
• SDKs for Node, Python and PHP, a CLI that tunnels webhooks to localhost, and an MCP server at /mcp.
• Prometheus metrics, Grafana dashboards and alert rules in monitoring/, and a Helm chart.

Docs

• Documentation and API reference
• Changelog, Upgrading
• Architecture, Operations, Contributing, Security

License

MIT. Self-hosted has every feature, with no licence key. Third-party notices: NOTICE, docs/licenses/.