Developer Tool for Webhook Replay & Secondary Safe-Haven

The webhook replay engine and secondary safe-haven for modern developers.

Stripe retries with exponential backoff for days, but constant 500 errors will eventually lock your endpoint. Use us as a secondary safe-haven. HookSentinel captures raw byte payloads into an encrypted Dead-Letter Queue and lets you replay failed events directly to production β€” or forward them to localhost via hs listen for instant debugging.

HMAC Verification100% Raw Bytes
Localhost Forwarding1-Click Local Replay
Retention BufferUp to 90 Days
Relay Overhead< 18ms Edge

πŸ” 100% HMAC Transparency & AES-256 Storage

AES-256 AT REST β€’ TLS 1.3

HookSentinel processes payloads strictly at the raw byte buffer level. It never mutates HTTP headers or re-serializes JSON, ensuring cryptographic signatures from Stripe, Shopify, and GitHub always pass verification.

All buffered webhook payloads in the Dead Letter Queue (DLQ) are encrypted at rest with AES-256 and transmitted exclusively over TLS 1.3.

HMAC Signatures Untouched
AES-256 Encrypted at Rest
Zero Payload Deserialization
Post-Mortem: Why Developers Need a Secondary Safe-Haven

"At 3:15 AM on a Sunday, our product launched on Hacker News. Traffic surged 10x. Our database connection pool saturated, and our /api/webhooks/stripe endpoint began throwing HTTP 500 errors.

Stripe retried the failed webhooks over the next hour. Because the database was still recovering, every retry failed. Stripe then marked our webhook endpoint as unhealthy and stopped sending events entirely.

By morning, 42 customers had been charged, but zero accounts had been upgraded. We had to spend 6 hours manually inspecting Stripe dashboard logs and writing throwaway scripts to backfill the missing subscriptions.

β€” Eren, Bootstrapped SaaS Founder (Fictional Example Scenario)Solution: Secondary Webhook Airbag with 1-Click Replay.

Anatomy of a Recovered Incident & Localhost Debugging

Here is what happens when your server fails, and how you reproduce it on your local machine:

14:02:10.120
INBOUNDStripe fires payment_intent.succeeded ($199.00)

Stripe sends POST request with HMAC Stripe-Signature header to HookSentinel secondary proxy endpoint.

14:02:10.840
500 ERRORProduction Destination crashes: DB lock timeout

HookSentinel captures the exact raw JSON body, all original HMAC headers, returns 200 OK to Stripe to prevent endpoint ban, and alerts your Slack channel.

14:05:00.000
LOCAL REPLAYClick "Replay to Localhost" β†’ localhost:3000

Never debug blindly in production. HookSentinel pushes the exact failed production payload into your local dev environment (http://localhost:3000/api/webhooks/stripe) with your debugger attached.

14:15:00.000
RESOLVEDBug Fixed. Click "Replay to Prod" β†’ HTTP 200 OK

The event is cleanly processed on production without writing throwaway data backfill scripts.

Raw Byte Signature Transparency

HookSentinel forwards bytes without touching a single character. Standard SDK signature verification works out of the box:

// app/api/webhooks/stripe/route.ts
// 1. In Stripe Dashboard, set Webhook URL to HookSentinel secondary endpoint:
//    https://www.hook-sentinel.tech/api/in/stripe-payments
// 2. HookSentinel relays the raw bytes untouched to your server (or localhost via 'hs listen'):

import { headers } from 'next/headers';
import Stripe from 'stripe';

const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!);

export async function POST(req: Request) {
  const body = await req.text(); // Raw buffer preserved exactly
  const signature = (await headers()).get('stripe-signature')!;

  try {
    const event = stripe.webhooks.constructEvent(
      body,
      signature,
      process.env.STRIPE_WEBHOOK_SECRET!
    );

    // Process event in your database or worker queue
    return new Response('ok', { status: 200 });
  } catch (err: any) {
    // If your origin or database crashes with HTTP 500, HookSentinel DLQ buffers the event!
    // Replay it with 1 click once the database is back up.
    return new Response(err.message, { status: 500 });
  }
}
Traffic Sentinel β€’ Alert Only Mode

Early Warning Alerts for Traffic Spikes & Card-Testing Bursts

Webhook volume isn't always steady. If your usual 1-2 webhooks/sec suddenly spikes to 30 requests in seconds due to a card-testing bot or infinite loop bug, HookSentinel immediately flags the spike and dispatches an alertβ€”without ever dropping or blocking payloads.

Burst Detection

Sliding-window velocity monitoring alerts your team the moment incoming rate surges beyond expected thresholds.

Never Drops Payloads

Legitimate customer payments are never dropped. All incoming requests are safely relayed and stored in the DLQ buffer.

Slack & Discord Alerts

Instant webhook alerts sent to your team's on-call channel with the route slug, request rate, and provider details.

Localhost CLI β€’ ngrok Alternative β€’ Zero-Config Developer Tunnel

Goodbye ngrok, Random URLs, and Port Forwarding Frustration

Stop juggling temporary ngrok URLs and re-registering webhooks in your Stripe dashboard every time you restart your dev server. With one simple terminal command (hs listen 3000), mirror live production webhooks straight to your local code.

bash β€’ Developer Local Machine (~/my-saas)
npx hooksentinel listen 3000
$npx hooksentinel listen 3000 --endpoint stripe-payments
β–² HookSentinel CLI (v1.0.0) β€” Zero-Config Webhook Mirroring
[βœ“] Connected to HookSentinel Hub (https://www.hook-sentinel.tech)
[βœ“] Active tunnel established for endpoint: stripe-payments
[βœ“] Forwarding incoming live webhooks -> http://localhost:3000/api/webhooks
Listening for Live Webhook Traffic...
⚑ [19:42:15] Webhook Received: customer.subscription.created (evt_1Nxe4a...)200 OK (18ms)
↳ Preserved Headers: stripe-signature, content-type β€’ Raw Bytes Verified
⚑ [19:43:02] Webhook Received: invoice.payment_failed (evt_3Mx01p...)500 ERR (12ms) - Captured in DLQ
↳ Set a breakpoint in your local IDE, fix the bug, and replay with 1 click from your dashboard!
Technical Guarantees

Frequently Asked Questions & Architecture

Architectural questions asked by developers:

Most standard reverse proxies and API gateways deserialize incoming JSON and re-serialize it before proxying. This alters key ordering, whitespace, or Unicode byte escapes, instantly invalidating HMAC-SHA256 signatures. HookSentinel clones the incoming HTTP request strictly at the raw byte-stream level and forwards it with byte-exact precision. Your existing stripe.webhooks.constructEvent logic continues to verify signatures with 100% fidelity without changing a single character of code.

Straightforward Pricing

No sales calls. Cancel anytime.

DEVELOPER
$0/ mo

For side projects and localhost development.

  • βœ“ 3,000 requests / mo
  • βœ“ 3-day log retention
  • βœ“ Slack & Discord alerts
  • βœ“ 1-Click Localhost Replay
Start Free
Developer Choice β€’ Most Popular
PRORECOMMENDED
$19/ mo

Reliable secondary safe-haven and replay engine for production apps.

  • βœ“ 50,000 requests / mo
  • βœ“ 30-Day raw payload retention
  • βœ“ 1-Click Replay (Prod & Localhost)
  • βœ“ Unlimited webhook routes
  • βœ“ Traffic Spike Sentinel Alerts
  • βœ“ Full JSON Log Export
Get Started ($19/mo)
SCALE
$49/ mo

For high-volume webhook workloads.

  • βœ“ 250,000 requests / mo
  • βœ“ 90-day payload retention
  • βœ“ Unlimited Localhost Tunnels
  • βœ“ High-throughput concurrency
Choose Scale ($49/mo)