ReHook Documentation

ReHook is a powerful webhook middleware that routes, transforms, and monitors webhook traffic from a single endpoint.

Quick Start

Get up and running in 5 minutes:

Core Concepts

Sources Configuration

Destinations Configuration

Transforms

Transforms use JavaScript to modify the payload. The function receives the event and must return the modified payload or null to skip.

// Example: Filter and reshape Stripe events
function transform(event) {
  // Skip non-payment events
  if (!event.type.startsWith('payment')) {
    return null;
  }
  
  // Reshape the payload
  return {
    type: event.type,
    amount: event.data.object.amount,
    currency: event.data.object.currency,
    customer: event.data.object.customer,
    timestamp: new Date().toISOString()
  };
}

Available Variables

Triggers

Triggers control which events are forwarded to a destination.

Trigger Types

API Authentication

All API requests require authentication using an API key.

# Include in request header
Authorization: Bearer rh_sk_xxxxxxxxxxxx

# Or as query parameter
?api_key=rh_sk_xxxxxxxxxxxx

API Key Scopes

Events API

Deliveries API

Sources API

Rate Limiting

ReHook uses a token bucket algorithm for rate limiting per destination.

Configuration

• rate_limit: Requests per second (e.g., 10 = 10 req/s)
• Backoff: 1s → 2s → 4s → 8s → ... up to 60s
• Circuit Breaker: Opens after 10 consecutive failures, 1 min cooldown

Retries & Dead Letter Queue

Retry Strategy

Failed deliveries are automatically retried with exponential backoff:

Attempt 1: Immediate
Attempt 2: After 1 second
Attempt 3: After 2 seconds
Attempt 4: After 4 seconds
... up to max_retries (default: 3)

Dead Letter Queue (DLQ)

Events that fail all retry attempts are moved to the DLQ. From the DLQ you can:

• Inspect the failure reason and response
• Replay the event to all destinations
• Retry only failed deliveries
• Resolve (acknowledge) the error

Event Status Flow

Security

Authentication Methods

Best Practices

• Rotate API keys regularly
• Use scoped keys with minimal permissions
• Enable HMAC verification for incoming webhooks
• Use HTTPS for all destination URLs

Error Handling

Common Error Codes