Sources
A source is a representation of a service that sends HTTP requests to the Hookdeck Event Gateway. For example, a third-party service sending webhooks, such as Shopify and Stripe, or an internal service making an HTTP request to distribute an event to other services, external or internal.
How sources work
Each source is given a unique Hookdeck URL that can be pasted into the HTTP or webhook URL field of the sender platform, or used within code when making the HTTP request.
Once HTTP requests are received by Hookdeck via the source URL, events are ingested and routed according to your connection rules.
Hookdeck is a platform for asynchronous messaging and therefore returns a basic customizable synchronous HTTP response to the client that has invoked the source URL. It is not possible to synchronously return a response from a destination to the client (for example, the result of an API call). However, you can use an asynchonous workflow to achieve this and send the result of any work done by a destination via a webhook callback. See the Hookdeck destination response FAQ for more information.
You can customize the source URL to use your own custom domain name. See Custom Domain for more information.
Source Types
Source Types help you quickly configure sources for specific platforms and services. When you select a Source Type, Hookdeck automatically sets up the appropriate configuration including authentication methods, required headers, and response formats commonly used by that platform.
For example, selecting the "Stripe" Source Type will automatically configure the source to handle Stripe's webhook signature verification and respond with the expected 200 status code.
With generic types such as "Webhook" and "HTTP" you can still customize the configuration to match your specific need regardless of the provider is directly supported by Hookdeck.
Source Types include popular platforms like:
Every source verifies signatures out of the box. Jump straight to its guide, agent skill, sample payloads, or official docs.
No sources match "".
Generic WEBHOOK and HTTP types work with any provider,
or request a new source type.
Content-types
Hookdeck aims to be compatible with every API provider and with common HTTP event payloads. To accomplish this, we remain platform-agnostic and ingest requests (up to 10 MiB) with one of the following content-types:
-
text/plain -
text/xml -
text/* -
application/json -
application/x-www-form-urlencoded -
application/xml -
application/xml-dtd -
application/*+xml -
application/*+json -
application/x-amz-json-1.0 -
application/x-amz-json-1.1 -
application/jwt -
application/x-ndjson -
multipart/form-data -
application/octet-stream -
application/pdf -
image/*
Binary payloads such as images, PDFs, and application/octet-stream are preserved as bytes for delivery.
If you encounter a problem integrating a specific API provider, send us a message.
Multipart requests
Hookdeck accepts multipart/form-data requests, such as form submissions and file uploads. On binary-safe connections, the original bytes are delivered and the form fields are available to search, filters, and transformations. See the multipart requests guide for details.
Create a source
Creating a source allows Hookdeck to begin receiving and routing events sent from a specific origin.
- Follow the instructions for creating a connection
- When configuring the source, select the appropriate Source Type from the dropdown
- Configure any additional settings specific to your chosen Source Type
{
"name": "something-else"
}{
"code": "RESOURCE_ALREADY_EXISTS",
"status": 409,
"message": "Resource already exists",
"data": {
"id": "src_v5lfi6g0iqsm38",
"resource_type": "source"
}
}curl -X POST "https://api.hookdeck.com/2026-09-01/sources" \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"name": "stripe-prod",
"type": "STRIPE",
"config": {
"auth": {
"webhook_secret_key": "whsec_..."
}
}
}'
Custom methods
POST, PUT, PATCH, and DELETE requests are accepted by default. GET, HEAD, and QUERY requests are not accepted by default, but you can enable them in the Source Configuration > Advanced Source Configuration section when creating or updating your sources.
You can also enable them explicitly by using a x-hookdeck-allow-methods query string parameter in your Hookdeck source URL e.g.
?x-hookdeck-allow-methods=get
Custom responses
Some API vendors modify their behavior based on the response they receive from a request. For these providers, Hookdeck supports setting custom responses to satisfy their requirements.
You can also use query string parameter x-hookdeck-response to explicitly customize the response. Append one of the following query parameters to the Hookdeck-provided source URL to achieve the desired response.
| Response | Query parameter example | Behavior |
|---|---|---|
| Empty | ?x-hookdeck-response=null or ?x-hookdeck-response | Hookdeck responds with an empty body |
| Text | ?x-hookdeck-response[text]=Hello+World | Hookdeck responds with the text Hello World |
| JSON | ?x-hookdeck-response[json]=%7B%22message%22%3A%22Hello%20World%22%7D | Hookdeck responds with the specified JSON |
| XML | ?x-hookdeck-response[xml]=<root><child></child></root> | Hookdeck responds with the specified XML |
Add source authentication
Requests can optionally be authenticated. While Source Types come with recommended authentication settings, you can customize these as needed. Hookdeck supports generic authentication options, HMAC, Basic Auth, and API Keys, which cover the majority of authentication providers.
If you've selected a specific Source Type, the authentication method will be pre-configured according to that platform's requirements. You'll only need to provide the necessary credentials.
Configure how incoming requests from a source are authenticated.
Over the API, authentication lives inside the source's config object. Generic types such as HTTP and WEBHOOK take an auth_type naming the scheme, plus an auth object holding its credentials. Platform Source Types such as STRIPE already know their scheme, so they take auth on its own.
- Open the Connections page.
- Click the source you want to authenticate.
- Click .
- Under Advanced Source Configuration, toggle the Source Authentication switch and select the appropriate authentication method from the dropdown.
- Enter the information required by the authentication method.
- Click .
{
"name": "shopify"
}{
"id": "src_qa5626p6y5o79b",
"team_id": "tm_lbhzBKgFOUnB",
"updated_at": "2026-01-14T13:36:41.934Z",
"created_at": "2026-01-14T13:35:55.226Z",
"name": "shopify",
"description": null,
"type": "WEBHOOK",
"config": {
"allowed_http_methods": [
"POST",
"PUT",
"PATCH",
"DELETE"
],
"custom_response": null,
"auth": null,
"auth_type": null
},
"disabled_at": null,
"url": "http://localhost:8787/qa5626p6y5o79b",
"authenticated": false
}curl -X PUT "https://api.hookdeck.com/2026-09-01/sources/src_123456789" \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"config": {
"auth_type": "HMAC",
"auth": {
"algorithm": "sha256",
"encoding": "base64",
"header_key": "x-webhook-signature",
"webhook_secret_key": "your_webhook_secret"
}
}
}'
All secrets are AES encrypted.
In the connection's page, your source will now have a shield icon next to it.
Edit source authentication
Edit a source to update the authentication method or change the credentials.
- Open the Connections page.
- Click the source you want to edit the authentication method for.
- Click .
- Scroll to Source Authentication under Advanced Source Configuration, and change the authentication method and related credentials.
- Click .
{
"name": "shopify"
}{
"id": "src_qa5626p6y5o79b",
"team_id": "tm_lbhzBKgFOUnB",
"updated_at": "2026-01-14T13:36:41.934Z",
"created_at": "2026-01-14T13:35:55.226Z",
"name": "shopify",
"description": null,
"type": "WEBHOOK",
"config": {
"allowed_http_methods": [
"POST",
"PUT",
"PATCH",
"DELETE"
],
"custom_response": null,
"auth": null,
"auth_type": null
},
"disabled_at": null,
"url": "http://localhost:8787/qa5626p6y5o79b",
"authenticated": false
}Remove source authentication
Removing authentication from a source will stop the authentication and verification of any incoming requests and all requests will be accepted.
- Open the Connections page.
- Click the source you want to remove authentication from.
- Click .
- Under Advanced Source Configuration, toggle off the Source Authentication switch.
- Click .
{
"name": "shopify"
}{
"id": "src_qa5626p6y5o79b",
"team_id": "tm_lbhzBKgFOUnB",
"updated_at": "2026-01-14T13:36:41.934Z",
"created_at": "2026-01-14T13:35:55.226Z",
"name": "shopify",
"description": null,
"type": "WEBHOOK",
"config": {
"allowed_http_methods": [
"POST",
"PUT",
"PATCH",
"DELETE"
],
"custom_response": null,
"auth": null,
"auth_type": null
},
"disabled_at": null,
"url": "http://localhost:8787/qa5626p6y5o79b",
"authenticated": false
}Edit a source
Editing a source lets you change the name of a source in your project.
- Open the Connections page.
- Click the source you want to edit.
- You can edit the source from inside the popup or click to edit in full page.
- Click .
{
"name": "shopify"
}{
"id": "src_qa5626p6y5o79b",
"team_id": "tm_lbhzBKgFOUnB",
"updated_at": "2026-01-14T13:36:41.934Z",
"created_at": "2026-01-14T13:35:55.226Z",
"name": "shopify",
"description": null,
"type": "WEBHOOK",
"config": {
"allowed_http_methods": [
"POST",
"PUT",
"PATCH",
"DELETE"
],
"custom_response": null,
"auth": null,
"auth_type": null
},
"disabled_at": null,
"url": "http://localhost:8787/qa5626p6y5o79b",
"authenticated": false
}Once a source has been renamed, its name is updated throughout the project and within any associated connection(s).
Disable a source
Disabling a source temporarily halts inbound requests at the associated Hookdeck URL. An HTTP 200 status code will still be returned for any request received on your Source URL.
This process also disables all the connections that are associated to that source.
- Open the Connections page.
- Click the source you wish to disable.
- Click button in the bottom right corner of the popup.
- Click .
{
"id": "src_qa5626p6y5o79b",
"team_id": "tm_lbhzBKgFOUnB",
"updated_at": "2026-01-14T13:36:41.948Z",
"created_at": "2026-01-14T13:35:55.226Z",
"name": "shopify",
"description": null,
"type": "WEBHOOK",
"config": {
"allowed_http_methods": [
"POST",
"PUT",
"PATCH",
"DELETE"
],
"custom_response": null
},
"disabled_at": "2026-01-14T13:36:41.947Z",
"url": "http://localhost:8787/qa5626p6y5o79b",
"authenticated": false
}curl -X PUT "https://api.hookdeck.com/2026-09-01/sources/src_123456789/disable" \
-H "Authorization: Bearer YOUR_API_KEY"
Enable a source
Enabling a source returns that source to its previously active state.
- Open the Connections page.
- Click the disabled source you wish to enable.
- Click button in the bottom right corner of the popup.
- Click .
{
"id": "src_qa5626p6y5o79b",
"team_id": "tm_lbhzBKgFOUnB",
"updated_at": "2026-01-14T13:36:41.959Z",
"created_at": "2026-01-14T13:35:55.226Z",
"name": "shopify",
"description": null,
"type": "WEBHOOK",
"config": {
"allowed_http_methods": [
"POST",
"PUT",
"PATCH",
"DELETE"
],
"custom_response": null
},
"disabled_at": null,
"url": "http://localhost:8787/qa5626p6y5o79b",
"authenticated": false
}curl -X PUT "https://api.hookdeck.com/2026-09-01/sources/src_123456789/enable" \
-H "Authorization: Bearer YOUR_API_KEY"
Hookdeck will resume ingesting requests from the enabled source. You may need to enable the associated connection(s) when the source was disabled or create new connections. Requests received from the source while it was disabled will not be available for replay.
Delete a source
Deleting a source permanently disables inbound requests at the associated Hookdeck URL. Hookdeck will return an HTTP 410 status code for any request received on your Source URL.
Associated event and request data is retained for the remainder of your retention window and will be displayed with a Source Deleted label.
This process also deletes all the connections that rely on the source.
- Open the Connections page.
- Click the source you wish to delete.
- Click button in the bottom right corner of the popup.
- Click .
- Click in the confirmation dialog.
{
"id": "src_qa5626p6y5o79b"
}curl -X DELETE "https://api.hookdeck.com/2026-09-01/sources/src_123456789" \
-H "Authorization: Bearer YOUR_API_KEY"
Once a source has been deleted, it will disappear from your list of sources and the Connections page.