Destinations

A URL where Hookdrop automatically forwards captured events, with optional HMAC signature verification.

A destination is a URL on your own infrastructure that Hookdrop forwards captured events to. When a request arrives at your endpoint, Hookdrop re-sends it to every destination you have configured — so your servers receive the webhook in real time.

Multiple destinations per endpoint

Each endpoint can have more than one destination. Hookdrop delivers every event to all of them simultaneously, which lets you fan out a single webhook stream to multiple environments without reconfiguring your provider.

Local development

Forward to localhost via a tunnel tool like ngrok or Cloudflare Tunnel while you build.

Staging

Forward to your staging server to run integration tests against real payloads.

Production

Forward to your production server once you’re ready to handle live events.

Add a destination

1. Open the endpoint

   In the dashboard, go to the endpoint you want to forward from and open the Destinations tab.

2. Add a destination URL

   Click + Add destination and enter the URL of your server, for example:

   https://your-server.com/webhooks/stripe
   
3. Optionally add a signing secret

   Enter a secret in the Signing secret field if you want Hookdrop to sign forwarded requests using HMAC-SHA256. Leave it blank to forward without a signature.

4. Save

   Click Save. Hookdrop will start forwarding new events to this destination immediately.

HMAC signing

When you set a signing secret on a destination, Hookdrop generates an HMAC-SHA256 signature over the request body and attaches it as a request header. Verify this signature on your server to confirm that requests are coming from Hookdrop and have not been tampered with.

Keep your signing secret private. Anyone with the secret can generate valid signatures. Rotate it immediately if it is ever exposed.

Delivery behavior

Hookdrop forwards each event to your destination with a 10-second timeout. If your server does not respond within that window, the attempt is treated as a failure and Hookdrop schedules a retry.

Every delivery attempt is logged with:

• HTTP response code returned by your server
• Response body
• Timestamp of the attempt

You can view delivery logs in the Deliveries tab of any event in the dashboard, or by calling the Events API reference.

For details on what happens when delivery fails repeatedly, see Retries & Dead Letter.

Manage destinations with the API

You can add and remove destinations programmatically. See the Destinations API reference.