Hookmetry configuration reference
Configure endpoints, validation, local forwarding, sharing, and replay through customer-facing controls. Keep provider secrets out of URLs and client-side code.
Endpoint settings
| Setting | Purpose |
|---|---|
| Name | Identifies the provider, environment, or workflow. |
| Description | Records operational context for the endpoint. |
| Validation type | Selects None, Stripe, GitHub, or Generic HMAC-SHA256 validation. |
| Webhook secret | Provides the provider signing secret when the selected validator requires it. |
| Active state | Controls whether the endpoint accepts new captures. |
Capture URL
Each endpoint has a unique public capture URL. Configure the complete URL at the sender and use POST with a non-empty body. The endpoint identifier is not a substitute for signature verification.
Generic HMAC secret rotation
- Regenerate the secret from the endpoint control or REST API.
- Copy the new secret to the sender through an approved secret-management process.
- Send a test event and confirm validation succeeds.
- Remove any stale copy of the previous secret.
CLI configuration
The CLI saves a bearer token locally. Protect it as a credential and revoke or replace it if the device is no longer trusted.
bash
hookmetry login
hookmetry status
hookmetry listen --endpoint <endpointId> --port 3000Replay and sharing
- Replay requires a complete target URL and sends the stored request to that target.
- Share links expose one debug session without requiring the viewer to sign in.
- Use short share expirations and revoke links after the collaboration ends.