Release-candidate self-hosted control plane

Self-hosted webhook evidence infrastructure

Durable capture, replay, delivery evidence, and audit trails for teams that need to prove what happened to webhook events.

Try the self-hosted quickstart Request commercial evaluation

Provider event verified raw bytes Durable receipt

Route version payload snapshot Signed delivery

Retry / replay reason captured Audit proof

Evidence survives delivery failure, replay, retention, and review.

What Webhookery proves

Designed around inspectable webhook history

Durable capture

Inbound success means raw request evidence and verification metadata were durably recorded.

Delivery control

Routes, retries, payload snapshots, delivery attempts, DLQ, and replay keep downstream outcomes visible.

Audit evidence

Audit-chain verification, retention metadata, and export packages help reviewers reconstruct decisions later.

How it works

Receive, verify, store, route, deliver, replay, audit

ReceivePreserve raw bytes and headers before trusting content.
VerifyApply provider-specific signatures and timestamp rules.
StoreCommit receipts, payload hashes, dedupe records, and audit events.
DeliverSend signed payload snapshots with retry and DLQ evidence.
RecoverReplay or reconcile where provider APIs make recovery possible.

Evaluator path

Run the evidence loop locally

Use the deterministic local demo to see valid ingest, invalid signature quarantine, retry, DLQ release, replay, retention, and audit-chain verification.

docker compose up -d postgres export WEBHOOKERY_TEST_DATABASE_URL=... examples/webhook-evidence-demo/run.sh make rc-check

Commercial path

AGPL public project, commercial exceptions available

Self-host under AGPL

Use the public repository when AGPL obligations fit your deployment and distribution model.

Read the license

Use commercially

Commercial evaluation, release evidence packages, production-readiness reviews, and support are available by written agreement.

Review commercial options

What this is not

Honest boundaries are part of the product

No exactly-once delivery claim.
No provider-side event completeness guarantee.
No claim that downstream business processing succeeded.
No compliance certification or legal evidence certification.
No live-provider calls in local release acceptance.