Documentation Menu

Creating & Securing Endpoints

In Hookmetry, an Endpoint acts as an intelligent, isolated ingress gateway for your webhooks. Instead of routing all traffic through a single generic URL, Hookmetry utilizes Sub-domain Isolation and Provider-Specific Validation Engines to ensure your inbound traffic is authenticated before it ever reaches your infrastructure.

The Architecture of an Endpoint

When you create an endpoint, Hookmetry generates a cryptographic URL (e.g., https://api.hookmetry.com/webhook/ep_abcdef123456). This URL is bound to specific security rules in our Edge layer.

  • DDoS Protection: Automated rate-limiting drops excessive bursts.
  • Signature Offloading: If configured, Hookmetry verifies HMAC signatures at the Edge. If a bad actor sends a forged payload, it is dropped with a 401 Unauthorized before your local tunnel or production server has to process it.

Configuring Provider Validation

Every webhook provider uses a slightly different hashing algorithm and header structure (e.g., Stripe uses Stripe-Signature and whsec_ secrets, while GitHub uses X-Hub-Signature-256 with Hex encoding).

When creating an endpoint, select your Provider and provide your signing secret. Hookmetry's Validation Engine will automatically apply the correct cryptographic checks.

Security Best Practice

Create separate endpoints for your Staging and Production environments. This ensures your staging data never poisons your production analytics, and allows you to rotate signing secrets independently.

Quick Setup Guide

  1. Navigate to the Endpoints tab in your Dashboard.
  2. Click New Endpoint.
  3. Select the Provider (e.g., Stripe, Shopify) or select "Custom" if rolling your own HMAC.
  4. Enter your Secret and Label.
  5. Copy the generated https://api.hookmetry.com/webhook/... URL and paste it into the third-party provider's settings.

Was this page helpful?

Your feedback helps us improve the docs.