AnyHook Docs

AnyHook requires no SDK, no code changes, and no package installation. The only step is replacing your webhook URL in your sender's dashboard.

1. 1
   Create an account

   Go to anyhook.net/sign-up and create a free account. No credit card required.
2. 2
   Create an App

   An App represents one webhook source. From your dashboard, click New App, give it a name (e.g. “Stripe Production”), and select the source type. AnyHook generates your inbound URL and a signing secret.
3. 3
   Configure your destination

   Enter the URL of your server endpoint — where AnyHook forwards events after receiving them. You can add multiple destinations per App.
4. 4
   Point your sender at AnyHook

   In your sender's dashboard (e.g. Stripe → Developers → Webhooks), replace the existing webhook URL with your AnyHook inbound URL:

   https://in.anyhook.net/{user-slug}/{app-slug}

   Your first event will appear in the AnyHook event log within seconds.

Every App gets a unique inbound URL:

https://in.anyhook.net/{user-slug}/{app-slug}

• user-slug — your account identifier, visible in dashboard settings.
• app-slug — unique per App, auto-generated from the app name but editable.

The inbound endpoint accepts any POST request. AnyHook returns HTTP 200within 50ms regardless of your destination endpoint's speed — the sender never waits.

AnyHook auto-detects the sender from incoming headers and validates the payload signature at the edge. To enable verification, select your webhook provider when creating an App and paste the provider's webhook signing secret (e.g. Stripe's whsec_...).

Signature validation failures are logged with full headers so you can diagnose mismatches without guessing. Invalid requests are rejected at the edge — they never reach your endpoint.

AnyHook uses an async, queue-based architecture to decouple your webhook sender from your backend:

1. Edge receive — Cloudflare Workers accepts the POST, validates the signature, and returns 200 in under 50ms.
2. Queue — The event is published to a durable message queue (Upstash QStash). The sender's HTTP connection is already closed.
3. Forward — QStash delivers the event to AnyHook's forwarder, which POSTs the original payload to your destination endpoint.
4. Log — Every step is recorded: inbound headers/body, delivery status, your endpoint's response code and body, latency.

When your destination returns a retryable error or times out, AnyHook automatically retries using exponential backoff:

Which responses trigger retries?

Not all errors are retryable. AnyHook classifies your endpoint's response to avoid wasting retry quota on errors that won't be fixed by trying again:

Each attempt is logged with the full response body and status code. Both 4xx terminal failures and retryable failures count toward the circuit breaker — 20 consecutive failures of any kind will trip it.

Failure notifications

AnyHook sends email alerts at specific thresholds rather than per event, so your inbox stays manageable:

• 1st failure — immediate alert with status code and destination.
• 5th consecutive failure — escalation alert with suggestions.
• 20th consecutive failure — circuit breaker trips (see below), CB alert sent.

Maximum 3 emails per incident — no matter how many events fail. Any single successful delivery resets the counter.

If AnyHook detects 20 consecutive delivery failures to the same destination (including terminal 4xx), the circuit breaker trips and begins a progressive escalation:

How it works

• Inbound keeps receiving. Your inbound URL stays active at all times — events from Stripe, GitHub, etc. are still accepted and stored. Only outbound delivery to your destination is paused.
• After each pause expires, AnyHook sends a half-open probe — the next event tests your destination. If it succeeds, the circuit closes and everything resets.
• Any single success resets everything — consecutive failure count and trip count both go back to zero.
• Events received during a pause are stored with status circuit_open and can be replayed once your destination recovers.
• You receive an email notification at each escalation step, including the destination URL, failure count, and pause duration.
• If the destination is deactivated (Trip 5), you must manually re-enable it from the dashboard.

This progressive approach gives your server time to recover while protecting your event quota from cascading failures.

Every inbound event is recorded regardless of delivery outcome. Each log entry includes:

• Full inbound headers and body (as received from the sender)
• Delivery status: queued → success / retrying / failed / circuit_open / quota_exceeded
• Your destination's HTTP response code and body (per attempt)
• Latency in milliseconds
• Attempt count and next retry time
• Whether the event is a replay (is_replay: true)

Events are retained for your plan's retention window: 3 days (Free), 30 days (Pro), 90 days (Scale), up to 365 days (Enterprise). After that, the payload is permanently deleted.

Any event in the log can be replayed from the dashboard with one click. A replay re-sends the original payload byte-for-byte to your current destination endpoint.

• Navigate to Dashboard → Events
• Find the event and click Replay
• A new event is created with is_replay: true, linked to the original

AnyHook works with local development out of the box — no special mode or CLI required. Two approaches:

1. Live forwarding via tunnel

Set your App's destination to a tunnel URL that points to your local machine. Any tunnel provider works:

# ngrok
ngrok http 3000
# → https://abc123.ngrok.io

# cloudflared
cloudflared tunnel --url http://localhost:3000

# localhost.run
ssh -R 80:localhost:3000 nokey@localhost.run

Copy the tunnel URL into your App's destination in the dashboard. AnyHook forwards webhooks there exactly like any other endpoint — retries, logging, and signature headers all work the same.

2. Capture & replay to localhost

Let real production events accumulate in AnyHook, then replay any of them to your local environment whenever you need. No need to trigger test events manually — test against real payloads, unlimited times.

• Switch your destination to your tunnel URL
• Open Dashboard → Events and click Replay on any event
• Or use the API: POST /api/v1/events/{id}/replay
• The original payload is sent byte-for-byte to your current destination

This is especially useful for debugging edge cases — find the problematic event in production logs, replay it locally, and iterate until your handler works correctly.

All webhook payload data is encrypted at rest using AES-256-GCM before it reaches the database. This includes inbound headers, request bodies, and per-destination signing secrets.

Encryption uses a dedicated key (AES_SECRET_KEY) that is stored separately from the database credentials. A database breach without the encryption key yields only ciphertext — no plaintext webhook data, no signing secrets, no customer information.

AnyHook validates webhook signatures at the Cloudflare edge in under 5ms. The validation happens before the event enters the queue — invalid or unsigned requests are dropped immediately.

Signature detection is automatic based on headers. When you create an App and select a source type, AnyHook stores the signing secret (encrypted at rest) and uses the correct algorithm for that provider.

Unsupported or custom sources

If your webhook source isn't in the supported list, select Generic when creating your App. AnyHook will:

• Accept and queue every inbound POST — no inbound signature check.
• Forward the original headers and body byte-for-byte to your destination.
• Attach an AnyHook-Signature header so your endpoint can still verify the request came through AnyHook.

If your custom source uses HMAC-SHA256 signing, you can configure a signing secret under the Generic source type — AnyHook will verify it at the edge using the header name you specify. For sources with non-standard algorithms, skip inbound verification and rely on AnyHook-Signature for trust.

All API requests require a Bearer token in the Authorization header:

Authorization: Bearer ak_live_xxxxxxxxxxxxxxxx

Generate API keys from Dashboard → Settings → API Keys. Keys are scoped to your account and can be revoked at any time.

See full pricing details →