> ## Documentation Index
> Fetch the complete documentation index at: https://bobprince-78964c2b.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Destinations

> A URL where Hookdrop automatically forwards captured events, with optional HMAC signature verification.

A destination is a URL on your own infrastructure that Hookdrop forwards captured events to. When a request arrives at your [endpoint](/concepts/endpoints), Hookdrop re-sends it to every destination you have configured — so your servers receive the webhook in real time.

## Multiple destinations per endpoint

Each endpoint can have more than one destination. Hookdrop delivers every event to all of them simultaneously, which lets you fan out a single webhook stream to multiple environments without reconfiguring your provider.

<CardGroup cols={3}>
  <Card title="Local development" icon="laptop">
    Forward to `localhost` via a tunnel tool like ngrok or Cloudflare Tunnel while you build.
  </Card>

  <Card title="Staging" icon="flask-conical">
    Forward to your staging server to run integration tests against real payloads.
  </Card>

  <Card title="Production" icon="server">
    Forward to your production server once you're ready to handle live events.
  </Card>
</CardGroup>

## Add a destination

<Steps>
  <Step title="Open the endpoint">
    In the dashboard, go to the endpoint you want to forward from and open the **Destinations** tab.
  </Step>

  <Step title="Add a destination URL">
    Click **+ Add destination** and enter the URL of your server, for example:

    ```
    https://your-server.com/webhooks/stripe
    ```
  </Step>

  <Step title="Optionally add a signing secret">
    Enter a secret in the **Signing secret** field if you want Hookdrop to sign forwarded requests using HMAC-SHA256. Leave it blank to forward without a signature.
  </Step>

  <Step title="Save">
    Click **Save**. Hookdrop will start forwarding new events to this destination immediately.
  </Step>
</Steps>

## HMAC signing

When you set a signing secret on a destination, Hookdrop generates an HMAC-SHA256 signature over the request body and attaches it as a request header. Verify this signature on your server to confirm that requests are coming from Hookdrop and have not been tampered with.

<Warning>
  Keep your signing secret private. Anyone with the secret can generate valid signatures. Rotate it immediately if it is ever exposed.
</Warning>

## Delivery behavior

Hookdrop forwards each event to your destination with a **10-second timeout**. If your server does not respond within that window, the attempt is treated as a failure and Hookdrop schedules a retry.

Every delivery attempt is logged with:

* HTTP response code returned by your server
* Response body
* Timestamp of the attempt

You can view delivery logs in the **Deliveries** tab of any event in the dashboard, or by calling the [Events API reference](/api-reference/events).

For details on what happens when delivery fails repeatedly, see [Retries & Dead Letter](/concepts/retries).

## Manage destinations with the API

You can add and remove destinations programmatically. See the [Destinations API reference](/api-reference/destinations).