How do I take webhooks without sharing my service URL?

Publish an EchoRelay endpoint to the sender. EchoRelay authenticates, validates, and rate-limits inbound traffic before delivery. Your service must be reachable by EchoRelay at a public network address, with its own access controls to restrict direct callers.

Are duplicate inbound webhooks handled?

They can be, on an endpoint you switch it on for. A sender that sets an Idempotency-Key header gets its repeat submission accepted once rather than twice. Senders you do not control often will not set one, and outbound delivery is at-least-once regardless — so design your service to tolerate an event arriving twice.

Can I validate inbound payloads?

Yes. Inbound payloads are checked against the schema you configure, so malformed data is rejected at the edge before it reaches you.

Webhook ingestion

Ingest webhooks without sharing your service URL.

Give third-party senders an EchoRelay endpoint, not your origin. We authenticate, validate, and rate-limit the inbound traffic, then hand clean events to your service.

Worked example

Receive shipment updates without sharing your service URL

Your shipping provider sends a dispatch event to EchoRelay. Your tracking app needs a smaller payload. This example uses fictional APIs and a sender that signs with a shared secret using Standard Webhooks.

Sender payload, accompanied by its signature headers

{
  "eventId": "evt_84",
  "type": "shipment.dispatched",
  "trackingNumber": "TRACK-9"
}

Your tracking app receives

{
  "eventId": "evt_84",
  "trackingNumber": "TRACK-9",
  "status": "dispatched"
}

Configure Standard Webhooks shared-secret verification and require trackingNumber in your validation rules.
Add your tracking service as an asynchronous target. Map the event ID and tracking number, and set status to the constant dispatched.
Publish and give the sender your EchoRelay URL. It supplies the signature headers with each event.

An invalid signature receives HTTP 401 before delivery. Keep the event ID so your tracking app can recognise duplicates. Your service must remain reachable by EchoRelay at a public network address; configure access controls there to restrict direct callers.

Configure the tracking payload mapping.

Why EchoRelay

Less to build, less to run.

A URL for your senders

Senders use an EchoRelay endpoint. Your service remains reachable by EchoRelay; configure its access controls to restrict direct callers.

Clean events only

Inbound payloads are checked against your schema — malformed data stops at the edge instead of reaching your service.

Rate-limited and allowlisted

Bursts and abuse hit us first. You decide who’s allowed and how fast.

Questions

Answered, honestly.

How do I take webhooks without sharing my service URL?: Publish an EchoRelay endpoint to the sender. EchoRelay authenticates, validates, and rate-limits inbound traffic before delivery. Your service must be reachable by EchoRelay at a public network address, with its own access controls to restrict direct callers.
Are duplicate inbound webhooks handled?: They can be, on an endpoint you switch it on for. A sender that sets an Idempotency-Key header gets its repeat submission accepted once rather than twice. Senders you do not control often will not set one, and outbound delivery is at-least-once regardless — so design your service to tolerate an event arriving twice.
Can I validate inbound payloads?: Yes. Inbound payloads are checked against the schema you configure, so malformed data is rejected at the edge before it reaches you.

Connect everything. Deploy nothing.

Start free See origin shield

No credit card required.