Developer libraries
hookshield
Standard Webhooks signing and verification with key rotation, replay protection and retrying delivery. Born from Mersal's event pipeline.
The problem
Every webhook has to be authentic, delivered once and survive flaky networks. Hand-rolled signing usually gets at least one of those wrong.
How it solves it
HookShield implements the Standard Webhooks signature scheme in PHP, and adds key rotation, replay protection and retries with exponential backoff. It works with Laravel, Symfony, WordPress or plain PHP.
Features
- Verified against the specification's reference test vector
- Constant-time verification with hash_equals
- Zero-downtime key rotation: sign with the newest secret, accept any configured one
- Replay protection with a timestamp tolerance and a nonce store
- Exponential backoff with full jitter, honouring Retry-After
- Redirects are not followed, and secrets are redacted and cannot be serialized
- Stable reason codes for every verification failure
Install and try
Who it is for
git clone https://github.com/mashraf1997/hookshield.git
composer config repositories.hookshield path ./hookshield
composer require mirrororg/hookshield:@devQuestions
Is hookshield free?
Yes. hookshield is open source under the MIT licence, so you can use it in personal and commercial projects.
What does it run on?
It is written in PHP. The README lists its requirements, usage and full API.
How do I report a problem?
Open an issue in the GitHub repository.
Does MirrorORG use it?
HookShield implements the Standard Webhooks signature scheme in PHP, and adds key rotation, replay protection and retries with exponential backoff. It works with Laravel, Symfony, WordPress or plain PHP.
More tools
bundle-budget
Node.jsPerformance budgets for build output (raw, gzip, brotli) with baselines, Markdown PR reports and CI exit codes.
arabic-kit
TypeScriptArabic toolkit: spelling-tolerant search, normalization, slugs, transliteration, digits, direction and number-to-words (تفقيط) for invoices.