Hookbox: a self-hosted webhook inbox with HMAC verification and replay

Hookbox: a self-hosted webhook inbox with HMAC verification and replay

Debugging webhooks without a proper inbox is painful: ngrok tabs everywhere, lost payloads, no way to prove a signature was valid.

Hookbox is a small self-hosted webhook inbox I built for that workflow.

Features

• Create an inbox with a unique capture URL (/h/{id})
• Capture any HTTP method — headers, query, body
• Optional HMAC verification (X-Hub-Signature-256 / X-Signature)
• Keep the last 100 events (body capped)
• Replay a captured event to a target URL
• Cookie / Authorization headers redacted in storage
• SSRF guards on replay targets
• Docker Compose one-command deploy

Quick start

git clone https://github.com/mamyan2001-gif/hookbox.git
cd hookbox
docker compose up --build
# → http://localhost:5070

Enter fullscreen mode Exit fullscreen mode

Design notes

I wanted something closer to RequestBin / webhook.site, but:

1. easy to run on your own machine or VPS
2. explicit about signature verification
3. careful about replay (don’t become an open SSRF proxy)

If you integrate Stripe, GitHub, or custom webhooks often, an inspect + replay loop saves a lot of time.

More from the same toolbox

• Seal — one-time secrets (AES-256-GCM)
• Pulseboard — HTTP uptime monitoring
• Dropkit — self-hosted file drop

I’m Artyom — full-stack (React / Node / TypeScript) in Yerevan, looking for remote work. Stars, issues, and harsh reviews on the SSRF/HMAC bits are all welcome.

GitHub: mamyan2001-gif/hookbox