Hookbox: a self-hosted webhook inbox with HMAC verification and replay

Hookbox: a self-hosted webhook inbox with HMAC verification and replay Debugging webhooks without a proper inbox is painful: ngrok tabs everywhere, lost payloads, no way to prove a signature was valid. Hookbox is a small self-hosted webhook inbox I built for that workflow. Features Create an inbox with a unique capture URL (/h/{id}) Capture any HTTP method — headers, query, body Optional HMAC verification (X-Hub-Signature-256 / X-Signature) Keep the last 100 events (body capped) Replay a captured event to a target URL Cookie / Authorization headers redacted in storage SSRF guards on replay targets Docker Compose one-command deploy Quick start git clone https://github.com/mamyan2001-gif/hookbox.git cd hookbox docker compose up --build # → http://localhost:5070 Enter fullscreen mode Exit fullscreen mode Design notes I wanted something closer to RequestBin / webhook.site, but: easy to run on your own machine or VPS explicit about signature verification careful about replay (don't become an open SSRF proxy) If you integrate Stripe, GitHub, or custom webhooks often, an inspect + replay loop saves a lot of time. More from the same toolbox Seal — one-time secrets (AES-256-GCM) Pulseboard — HTTP uptime monitoring Dropkit — self-hosted file drop I'm Artyom — full-stack (React / Node / TypeScript) in Yerevan, looking for remote work. Stars, issues, and harsh reviews on the SSRF/HMAC bits are all welcome. GitHub: mamyan2001-gif/hookbox