Open source · self-hosted
Signal in. Verified. Delivered.
Kook is an open-source webhook gateway that sits between any provider and your application. It verifies every request is genuinely who it claims to be, retries what fails, and keeps a permanent record of it all, running on a server you control.
Verifies signatures from
What it does
Everything a webhook needs on the way in
Not a queue you have to wire up yourself: a complete gateway that verifies, retries, logs, and alerts, running entirely on your own infrastructure.
Signature verification
Confirms every request is genuinely from the provider, using each provider's own signing scheme, before anything happens with it.
Automatic retries
A failed delivery retries at 30s, 2m, 10m, 30m, then 1h: six attempts before it's marked failed.
Full delivery log
Every attempt is recorded: status code, response body, timing. Nothing about a delivery is a mystery.
Failure alerts
Get an email the moment an endpoint exhausts its retries, with a one-click toggle if you'd rather not.
Append-only audit log
Every action on your account is logged, and can never be edited or deleted, not even by you.
Own your infrastructure
One Docker Compose file. Your database, your Redis, your server. No third party ever sees your payloads.
Two modes
Pick a mode per endpoint
Every endpoint you create is either relay or managed. Switch whenever the source changes, nothing else about Kook cares which one you pick.
Relay
Bring your own everything
Point any webhook source at Kook. No provider, no secret, no setup, just an endpoint URL.
- Works with any source, not only the built-in providers
- Forwards the exact payload, byte for byte, original headers included
- Kook doesn't verify a signature, your app handles that itself if it needs to
Managed
Let Kook verify it for you
Pick a provider and paste in your webhook secret. Kook checks every signature before anything is accepted.
- Built-in support for Stripe, GitHub, Shopify, Paystack, Flutterwave, or your own HMAC secret
- Invalid signatures are rejected before they ever reach your server
- Forwarded as JSON, signed with Kook's own HMAC so your app can verify it came from Kook
How it works
Three steps, every time
The same sequence for every event, whether it's the first one you've ever received or the millionth.
Point a provider at Kook
Give Stripe, GitHub, or your own service the unique URL Kook generates for each endpoint.
Kook checks it and logs it
The signature is verified, the raw payload is stored, and the event shows up in your dashboard immediately.
It's relayed, and retried until it lands
In relay mode, your server gets the exact payload the provider sent, byte for byte, original headers included. If it's down, Kook keeps trying so you keep building.
The retry schedule
Six attempts, back off automatically
Self-hosting
Deploy in two commands
- Postgres and Redis run alongside it, so there's nothing separate to provision.
- Works with plain Docker Compose or a one-click Dokploy deploy.
- MIT licensed. Fork it, audit it, run it forever without asking anyone.
# grab the compose file curl -O .../kook/main/docker-compose.yml
# set your four env vars, then docker compose --env-file .env.docker up -d