Webhook infrastructure
for developers

Sparrow is open-source webhook delivery with guaranteed at-least-once delivery, intelligent retries, and full observability. One binary. One database. Production-ready in minutes.

Get started API reference

Open source Go + PostgreSQL 34 API endpoints

terminal

$ curl -X POST http://localhost:8080/webhook.EventService/PushEvent \ -H "Content-Type: application/json" \ -H "X-API-Key: sk_live_..." \ -d '{ "namespace": "payments", "event": "invoice.paid", "payload": '{"id":"inv_01","amount":4999}', "id": "idem_abc123" }' // Response { "eventId": "evt_7f3a...", "duplicate": false }

DELIVERY PIPELINE

Every event delivered. Every failure classified.

Events are persisted in PostgreSQL before delivery begins. River workers fan out to matching subscriptions, apply Go template transforms, and deliver via HTTP with exponential backoff.

Errors are classified into 10 categories — retryable (5xx, timeout, 429, connection refused) and non-retryable (4xx, DNS, TLS) — so you always know why a delivery failed.

How it works

PushEvent Validate, persist, dedup

Fan-out Match subscriptions, transform

Queue River workers, rate limiting

Deliver HTTP POST, HMAC + Ed25519

Retry Classify, backoff, health track

SECURITY

Dual cryptographic signatures on every delivery

Every webhook delivery is signed with both HMAC-SHA256 and Ed25519. Consumers choose which to verify — shared secret or public key. No configuration needed; both signatures ship on every request.

Secrets and sensitive headers are envelope-encrypted at rest using AES-256-GCM with per-record keys. SSRF protection blocks private, loopback, and cloud metadata IPs.

Webhook API

delivery headers

webhook-id: msg_d4e5f6a1b2c3... webhook-timestamp: 1714567890 webhook-signature: v1,K7gNU3sdo+OL0... v1a,9f8e7d... Content-Type: application/json

OBSERVABILITY

Traces, metrics, and logs — built in, not bolted on

OpenTelemetry traces propagate through every River job. Structured logs and metrics export via OTLP to your collector of choice. Per-webhook health tracking classifies delivery outcomes into healthy, degraded, or unhealthy states.

The embedded SvelteKit dashboard gives you a real-time view of deliveries, health, and event history — no external tooling needed for day-one visibility.

Architecture

DELIVERIES / 24H 12,847

SUCCESS RATE 99.7%

P95 LATENCY 142ms

ACTIVE WEBHOOKS 38

ALSO INCLUDED

Payload transforms

Go template transforms per subscription with safe fallback to envelope payload on failure.

Envelope encryption

Webhook secrets and sensitive headers are protected with AES-256-GCM envelope encryption and per-record keys.

Per-webhook rate limits

Leaky bucket rate limiting per webhook. 429 Retry-After parsing with cap at 15 minutes.

Dual signing

Every delivery includes HMAC-SHA256 and Ed25519 signatures so consumers can verify with shared secrets or public keys.

Batch operations

Snapshot-based bulk re-push and retry. What you search is what you act on — deterministic.

gRPC + HTTP

Native gRPC on :50051 and Connect-RPC on :8080. Same API, same behavior.

GET STARTED

Docker Compose to production

Sparrow ships as a single Go binary. Add PostgreSQL and you have a production webhook system. No Redis, no Kafka, no additional infrastructure.

Installation guide Deploy on Railway