Sparrow is a self-hosted webhook delivery platform built for teams that want full control over their webhook infrastructure. No per-message pricing, no vendor lock-in, no external dependencies beyond PostgreSQL.
Sparrow is MIT-licensed, and all core features are available in the open-source codebase (including envelope encryption, webhook signing, retries, and health tracking).
Production-Grade Delivery
At-least-once delivery with exponential backoff, 10-category error classification, per-webhook health tracking (healthy/degraded/unhealthy state machine), and automatic retry logic that distinguishes retryable failures from permanent ones.
Cryptographic Signing
Every delivery is dual-signed with both HMAC-SHA256 and Ed25519 using the Standard Webhooks format. Consumers choose which signature to verify. Per-webhook keypairs are generated automatically.
Encryption at Rest
Webhook secrets, signing keys, and sensitive headers are envelope-encrypted with AES-256-GCM and per-record data encryption keys. Not just “encrypted in the database” — actual envelope encryption with key hierarchy.
Zero External Dependencies
PostgreSQL is the only infrastructure requirement. No Redis, no message broker, no object storage. The River job queue runs inside PostgreSQL. One database to back up, monitor, and scale.
The table below compares Sparrow with the main alternatives for webhook delivery: Svix (open-source + cloud), Convoy (open-source), Hookdeck (SaaS platform with open-source Outpost agent), AWS SNS (managed), and building it yourself (DIY).
| Capability | Sparrow | Svix | Convoy | Hookdeck | AWS SNS | DIY |
|---|---|---|---|---|---|---|
| Fully open source (MIT) | Yes | Partial (OSS core, paid features) | Yes (MPL-2.0) | Partial (Outpost OSS, core platform closed) | No | Yes |
| Self-hosted | Yes | Yes | Yes | Partial (Outpost self-hosted, platform SaaS) | No (Managed) | Yes |
| No vendor per-message pricing (self-hosted) | Yes (self-hosted; infra only) | No | Yes (OSS self-hosted) | No | No | Yes (your infra only) |
| Infra complexity (core deps) | PostgreSQL only | PostgreSQL + Redis | PostgreSQL + Redis (or Mongo + Redis) | SaaS | Managed | Varies |
| Job queue backend | PostgreSQL (River) | Redis-backed queue/workers | Background workers + Redis | Managed | Managed | Varies |
| Webhook signing | Dual HMAC-SHA256 + Ed25519 | HMAC-SHA256 | HMAC-SHA256 | HMAC-SHA256 | X.509 signature (not HMAC) | Manual |
| Security model for secrets | Envelope encryption with per-record DEKs | Encrypted at rest (service-managed keys) | Deployment-dependent (no built-in envelope hierarchy) | Vendor-managed encryption | Vendor-managed encryption | Manual |
| Payload transformation | Go templates per subscription (50+ functions) | Varies by edition/plan | Yes (JS transform) | Yes (JS transform) | No | Manual |
| Per-webhook rate limiting | Leaky bucket (DB-backed) | Available (details vary) | Yes | Yes | Regional quotas | Manual |
| Delivery semantics | At-least-once + explicit idempotency model | At-least-once + retries | At-least-once + retries | At-least-once + replay | At-least-once | Varies |
| Delivery health model | State machine (healthy/degraded/unhealthy) | Endpoint status | Circuit breaker | Dashboard metrics | CloudWatch | Manual |
| Error classification | 10 protocol-aware categories with retryability flags | Basic status and error reporting | Success/failure | Categorized | CloudWatch | Manual |
| Bulk retry/re-push | Deterministic snapshot-based (up to 10K) | Not in OSS | Manual retry | UI retry | No | Manual |
| Idempotent ingestion | Built-in dedup with idempotency keys | Application-level (no OSS ingest dedup) | Event IDs | Dedup available | Message dedup (5min) | Manual |
| gRPC / Connect-RPC | Yes (dual protocol) | No (REST) | No (REST) | No (REST) | No | Manual |
| Web dashboard | Embedded SvelteKit | Included | Included | Included | Console | No |
| Tracing & metrics | OpenTelemetry (traces + metrics + logs, job-level propagation) | Logging | Prometheus metrics | Dashboard | CloudWatch | Manual |
| SSRF protection | Built-in (private IPs, redirects) | Built-in controls (plus proxy best practices) | Built-in controls / IP filtering | Managed | N/A | Manual |
| Client SDKs | 3 (Go, Python, TypeScript) | Broad coverage | Multiple | Multiple | All AWS SDKs | 0 |
| Consumer app portal | No | Yes (embeddable) | No | No | No | No |
| Multi-region / HA story | PostgreSQL-native HA + stateless workers | Vendor/infra-managed | Vendor/infra-managed | Vendor-managed | Global managed service | Manual |
| Multi-tenant SaaS mode | No (single-tenant focus) | Yes | Yes | Yes | Yes | Manual |
Since Svix is the closest competitor architecturally, here’s a deeper look:
| Capability | Sparrow | Svix OSS |
|---|---|---|
| Event schema validation | Soft validation (warnings, never rejects) | JSON Schema (hard reject) |
| Namespace isolation | Built-in logical separation | Application-level |
| Dual protocol API | gRPC on :50051 + Connect-RPC (HTTP/JSON) on :8080 | REST API only |
| Helm chart | Security-hardened (NetworkPolicy, seccomp, read-only rootfs) | Available |
| Container image | Distroless (~15MB), non-root | Standard |
Sparrow runs anywhere you can run a container and connect to PostgreSQL:
