A source is a representation of a service that sends HTTP requests to the Hookdeck Event Gateway. For example, a third-party service sending webhooks, such as Shopify and Stripe, or an internal service making an HTTP request to distribute an event to other services, external or internal.

How sources work

Each source is given a unique Hookdeck URL that can be pasted into the HTTP or webhook URL field of the sender platform, or used within code when making the HTTP request.

Once HTTP requests are received by Hookdeck via the source URL, events are ingested and routed according to your connection rules.

Hookdeck is a platform for asynchronous messaging and therefore returns a basic customizable synchronous HTTP response to the client that has invoked the source URL. It is not possible to synchronously return a response from a destination to the client (for example, the result of an API call). However, you can use an asynchonous workflow to achieve this and send the result of any work done by a destination via a webhook callback. See the Hookdeck destination response FAQ for more information.

You can customize the source URL to use your own custom domain name. See Custom Domain for more information.

Source Types

Source Types help you quickly configure sources for specific platforms and services. When you select a Source Type, Hookdeck automatically sets up the appropriate configuration including authentication methods, required headers, and response formats commonly used by that platform.

For example, selecting the "Stripe" Source Type will automatically configure the source to handle Stripe's webhook signature verification and respond with the expected 200 status code.

With generic types such as "Webhook" and "HTTP" you can still customize the configuration to match your specific need regardless of the provider is directly supported by Hookdeck.

Source Types include popular platforms like:

Content-types

Hookdeck aims to be compatible with every API provider and with common HTTP event payloads. To accomplish this, we remain platform-agnostic and ingest requests (up to 10 MiB) with one of the following content-types:

• text/plain
• text/xml
• text/*
• application/json
• application/x-www-form-urlencoded
• application/xml
• application/xml-dtd
• application/*+xml
• application/*+json
• application/x-amz-json-1.0
• application/x-amz-json-1.1
• application/jwt
• application/x-ndjson
• multipart/form-data
• application/octet-stream
• application/pdf
• image/*

Binary payloads such as images, PDFs, and application/octet-stream are preserved as bytes for delivery.

If you encounter a problem integrating a specific API provider, send us a message.

Multipart requests

Hookdeck accepts multipart/form-data requests, such as form submissions and file uploads. On binary-safe connections, the original bytes are delivered and the form fields are available to search, filters, and transformations. See the multipart requests guide for details.

Create a source

Creating a source allows Hookdeck to begin receiving and routing events sent from a specific origin.

Custom methods

POST, PUT, PATCH, and DELETE requests are accepted by default. GET, HEAD, and QUERY are not, and each has to be enabled per source in the Source Configuration > Advanced Source Configuration section when creating or updating your sources.

A request using a method the source hasn't enabled is answered with a 405 and recorded as a rejected request with the UNSUPPORTED_HTTP_METHOD rejection cause, so you can see it in the dashboard rather than having to guess why it never arrived.

You can also enable methods for a single request by using a x-hookdeck-allow-methods query string parameter in your Hookdeck source URL. This replaces the source's configured methods for that request rather than adding to them.

?x-hookdeck-allow-methods=get,head

GET and HEAD

Neither carries a request body, so the request is ingested and delivered without one, and without its content-type and content-length headers.

A response to a HEAD carries no body, as RFC 9110 requires. The request ID that other methods return in the response body is returned in the x-hookdeck-request-id response header instead.

Enabling HEAD on a source means uptime monitors, link checkers, and link preview crawlers become billable requests against it, since those tools send HEAD to any URL they encounter.

QUERY

QUERY is safe and idempotent like GET, but it carries a request body like POST. Hookdeck treats it as a body-carrying method throughout: the body, content-type, and content-length are preserved on both ingestion and delivery, and body signature verification works normally.

Custom responses

Some API vendors modify their behavior based on the response they receive from a request. For these providers, Hookdeck supports setting custom responses to satisfy their requirements.

You can also use query string parameter x-hookdeck-response to explicitly customize the response. Append one of the following query parameters to the Hookdeck-provided source URL to achieve the desired response.

Response	Query parameter example	Behavior
Empty	?x-hookdeck-response=null or ?x-hookdeck-response	Hookdeck responds with an empty body
Text	?x-hookdeck-response[text]=Hello+World	Hookdeck responds with the text Hello World
JSON	?x-hookdeck-response[json]=%7B%22message%22%3A%22Hello%20World%22%7D	Hookdeck responds with the specified JSON
XML	?x-hookdeck-response[xml]=<root><child></child></root>	Hookdeck responds with the specified XML

Add source authentication

Requests can optionally be authenticated. While Source Types come with recommended authentication settings, you can customize these as needed. Hookdeck supports generic authentication options, HMAC, Basic Auth, API Keys, and Standard Webhooks, which cover the majority of authentication providers.

If you've selected a specific Source Type, the authentication method will be pre-configured according to that platform's requirements. You'll only need to provide the necessary credentials.

Configure how incoming requests from a source are authenticated.

Over the API, authentication lives inside the source's config object. Generic types such as HTTP and WEBHOOK take an auth_type naming the scheme, plus an auth object holding its credentials. Platform Source Types such as STRIPE already know their scheme, so they take auth on its own.

All secrets are AES encrypted.

In the connection's page, your source will now have a shield icon next to it.

Edit source authentication

Edit a source to update the authentication method or change the credentials.

Remove source authentication

Removing authentication from a source will stop the authentication and verification of any incoming requests and all requests will be accepted.

Edit a source

Editing a source lets you change the name of a source in your project.

Once a source has been renamed, its name is updated throughout the project and within any associated connection(s).

Disable a source

Disabling a source temporarily halts inbound requests at the associated Hookdeck URL. An HTTP 200 status code will still be returned for any request received on your Source URL.

This process also disables all the connections that are associated to that source.

Enable a source

Enabling a source returns that source to its previously active state.

Hookdeck will resume ingesting requests from the enabled source. You may need to enable the associated connection(s) when the source was disabled or create new connections. Requests received from the source while it was disabled will not be available for replay.

Delete a source

Deleting a source permanently disables inbound requests at the associated Hookdeck URL. Hookdeck will return an HTTP 410 status code for any request received on your Source URL.

Associated event and request data is retained for the remainder of your retention window and will be displayed with a Source Deleted label.

This process also deletes all the connections that rely on the source.

Once a source has been deleted, it will disappear from your list of sources and the Connections page.