standard-webhooks: Open Source API Development & Testing

What is standard-webhooks?

Standard Webhooks is the open specification, plus a set of reference libraries, that defines how services should sign, send and verify HTTP callbacks, written for API providers that emit webhooks and the developers who receive them.

What it is

Standard Webhooks is a community-driven specification and toolset for sending webhooks easily, securely and reliably. It describes itself as a design document outlining a proposal: a set of strict webhook guidelines based on existing industry best practices. The human-readable markdown file at spec/standard-webhooks.md is the source of truth for the specification, and the latest draft there tracks the latest commit to the main branch of the repository. The project lives in the API development and testing ecosystem, alongside HTTP callbacks and API description formats, and its stated ambition is to do for webhooks what JWT did for API authentication.

The concrete problem it addresses is fragmentation. Webhooks are used by many of the world's top companies for sending events to users of their APIs, but the ecosystem is split across providers that each ship different implementations of varying quality. Even high quality implementations vary, which makes them inherently incompatible. Consumers must handle webhooks differently for every provider, relearn how to verify them, and encounter gotchas with bespoke implementations. Providers reinvent the wheel and redesign for issues that have already been solved, such as security and forward compatibility. Standard Webhooks replaces those per-provider webhook signing and verification conventions with one consistent protocol supported by independent implementations.

Key capabilities

Publishes the specification itself as spec/standard-webhooks.md, a human-readable markdown draft that acts as the source of truth and follows the main branch.
Ships a Python reference implementation for signature verification, published as standardwebhooks on PyPi.
Ships a JavaScript and TypeScript implementation as standardwebhooks on NPM.
Ships a Ruby implementation as standardwebhooks on RubyGems, a Rust implementation as standardwebhooks on crates.io, and a Go implementation as the module github.com/standard-webhooks/standard-webhooks/libraries/go.
Ships a Java and Kotlin implementation as com.standardwebhooks:standardwebhooks on Maven Central and a C# implementation as StandardWebhooks.StandardWebhooks on nuget.
Lists further reference implementations for PHP and Elixir, and community implementations including C# (.NET) at codefactors/StandardWebhooks and Haskell.
Carries topics covering api, asyncapi, callbacks, http, json and openapi, tying the specification to common API description formats.

Who uses it and how

API providers that emit events to their users' APIs, replacing bespoke webhook signing and delivery conventions with one published protocol.
Consumers of webhooks from multiple providers, who otherwise verify each provider's callbacks differently and must relearn verification per integration.
Polyglot engineering teams, since the signature verification libraries cover Python, JavaScript and TypeScript, Java and Kotlin, Rust, Go, Ruby, PHP, C#, and Elixir, so a service written in any of those languages can verify with a native package.
Specification authors and platform teams that track the draft in spec/standard-webhooks.md and follow the latest commit to main, treating guidelines as the stable interface between senders and receivers.
Teams working with asyncapi and openapi tooling, since the specification is intended to interoperate with existing API description work rather than sit beside it.

Getting started

Install the reference library for the relevant language: standardwebhooks from PyPi, NPM, RubyGems or crates.io, com.standardwebhooks:standardwebhooks from Maven Central, StandardWebhooks.StandardWebhooks from nuget, or the Go module path. Read the specification first at spec/standard-webhooks.md.

How it compares

No list of paid products that this project replaces is provided in the facts, and no directly comparable tool is named either, so it stands alone in this registry.

When to use it — and when not

Adopters operate their own HTTP servers on both sides of the exchange, since the specification describes server-to-server callbacks and the bundled libraries cover the signature verification theme rather than hosting, delivery, storage or retry infrastructure. The specification is still at draft stage, which is a real consideration for teams that require a frozen standard before committing, and the repository carries 62 open issues. Teams that want a managed webhook delivery service with dashboards and retries should look elsewhere, because no such hosted offering is described in the facts provided here.

project readme (upstream, from github) — read inline

Open source tools and guidelines for sending webhooks easily, securely, and reliably

Introduction

Webhooks are becoming increasingly popular and are used by many of the world's top companies for sending events to users of their APIs. However, the ecosystem is fragmented, with each webhook provider using different implementations and varying quality. Even high quality implementations vary, making them inherently incompatible. This fragmentation is a pain for the providers and consumers, stifling innovation.

For consumers, this means handling webhooks differently for every provider, relearning how to verify webhooks, and encountering gotchas with bespoke implementations. For providers, this means reinventing the wheel, redesigning for issues that have already been solved (security, forward compatibility, etc.).

We propose a simple solution: standardize webhooks across the industry. This design document outlines our proposal, a set of strict webhook guidelines based on the existing industry best practices. We call it "Standard Webhooks".

We believe "Standard Webhooks" can do for webhooks what JWT did for API authentication. Adopting a common protocol that is consistent and supported by different implementations will solve the above issues, and will enable new tools and innovations in webhook ecosystem.

To achieve this, we have created an open source and community-driven set of tools and guidelines for sending webhooks.

What are Webhooks?

Webhooks are a common name for HTTP callbacks, and are a way for services to notify each other of events. Webhooks are part of a service's API, though you can think of them as a sort of a "reverse API". When a client wants to make a request to a service they make an API call, and when the service wants to notify the client of an event the service triggers a webhook ("a user has paid", "task has finished", etc.).

Webhooks are server-to-server, in the sense that both the customer and the service in the above description, should be operating HTTP servers, one to receive the API calls and one to receive the webhooks. It's important to note that while webhooks usually co-exist with a traditional API, this is not a requirement, and some services send webhooks without offering a traditional API.

Read the specification

The latest draft specification can be found at spec/standard-webhooks.md which tracks the latest commit to the main branch in this repository. The human-readable markdown file is the source of truth for the specification.

Reference implementations

There are reference implementations for the signature verification theme for a variety of languages, including:

Python - standardwebhooks on PyPi.
JavaScript/TypeScript - standardwebhooks on NPM.
Java/Kotlin - com.standardwebhooks:standardwebhooks on Maven Central.
Rust - standardwebhooks on crates.io.
Go - github.com/standard-webhooks/standard-webhooks/libraries/go as a Go module.
Ruby - standardwebhooks on RubyGems.
PHP
C# - StandardWebhooks.StandardWebhooks on nuget.
Elixir

Community implementations

Tools

receiving-webhooks: an AI skill that teaches agents to verify webhooks the right way.

Technical steering committee

The Standard Webhooks initiative, the specification, and development of tooling is driven by the community and guided by the technical steering committee.

Members (in alphabetical order):

Compatible implementations

Standard Webhooks has been adopted by a variety of companies including: OpenAI, Anthropic, Google Gemini, Kong, Svix, Supabase, Vanta, Drata, Etsy, PagerDuty, Twilio, TaskRabbit and many others.

Example ecosystem benefits of Standard Webhooks

We believe "Standard Webhooks" can do to webhooks what JWT did to API authentication. Having a common protocol that is consistent will enable a variety of implementations to interoperate, reducing the development burden on webhook consumers and enabling new uses. Some of these benefits include:

API Gateway signature verification: signature verification is a common challenge for webhook consumers. Standard Webhooks makes it possible for verification to be implemented directly in the API gateway, easily solving verification for consumers.
Having a set of libraries for signing and verification make webhook verification easier for scenarios where API gateways can't be used.
Workflow automation tools (such as Zapier, Make, Workato, and tray.io) can implement the signature verification themselves to ensure a secure integration and save the need for integration builders to reinvent the wheel every time.
Standard Webhooks will enable building tools to automatically generate SDK for webhook consumers that in addition to verifying the signature can also validate the schemas (using JSON Schema, OpenAPI or AsyncAPI definitions).
Many more...

Related efforts

There are a few complementary or partially overlapping efforts to standardize asynchronous event communication. This specification is compatible with the rest of them, and can either reuse existing efforts or benefit further from collaboration with them. The most notable of such efforts are:

Active Projects

In-active Projects

RestHooks

Frequently asked questions

Is standard-webhooks free to use?

standard-webhooks is open source under the Apache-2.0 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does standard-webhooks do?

The Standard Webhooks specification

What is standard-webhooks written in?

standard-webhooks is primarily written in Java. Its source is publicly available at https://github.com/standard-webhooks/standard-webhooks, and it has 1,748 GitHub stars.