Webhook relay · by AS2Expert

Webhooks, delivered.
Even behind CGNAT.

One persistent public URL for Stripe, M-Pesa, MercadoPago, WhatsApp, GitHub and any other provider. We store every payload, retry with backoff and forward it signed to your server — or straight to your laptop through a tiny local agent.

No credit card 100 events a month free Hosted in the EU Open-source agent
Stripepayment_intent.succeeded GitHubpush · pull_request WhatsAppmessages M-PesaSTK callback MercadoPagopayment.updated Relay store · sign · retry 202 in < 50 ms HMAC-SHA256 signed Your serverHTTPS · verified Your laptoprelay-agent · CGNAT
Works with any provider Stripe GitHub Shopify WhatsApp MercadoPago M-Pesa Twilio PayPal Zapier
< 50msto acknowledge a webhook — the provider never times out
30daysof retries with exponential backoff on Pro and Business
10MiBmaximum payload, stored byte-for-byte with its headers
0public IPs needed — the agent dials out over TLS

Everything a webhook needs on its way to you

Ingest, durability, delivery and observability — without running your own queue, tunnel or public server.

Never lose a webhook

Every payload is persisted before we answer 202. Retries for up to 30 days, a full attempt log and one-click replay from the dashboard.

Local agent for CGNAT

No public IP, dynamic address, office NAT? relay-agent for Linux, macOS and Windows dials out over TLS and receives your webhooks locally. Events wait while it is offline.

Signed and verified

Every forwarded request carries X-Relay-Signature (HMAC-SHA256). Optionally we check the provider's own signature — Stripe, GitHub — before storing anything.

Alerts where you work

Email, Slack, Discord, Microsoft Teams or a webhook of your own when deliveries are exhausted or the failure rate climbs. One notification when it opens, one when it resolves.

Filter, rewrite, fan out

Up to 20 destinations per endpoint, each with JSON filters, header and method rewrite, throttling and its own retry profile. Synchronous provider responses on paid plans.

Built for production

Two-factor sign-in, destination ownership verification, anti-SSRF on every hop, audit trail, data export and deletion. Stripe billing with VAT invoices.

How it works

Ingest answers in milliseconds; delivery happens asynchronously with retries at 1 m, 5 m, 15 m, 1 h, 6 h, 24 h and onward, depending on the destination's retry profile.

1

Create an endpoint

You get https://relays.as2expert.com/e/rt_…. Paste it into your provider.

2

We store & queue

Raw body and headers are persisted; the provider gets a 202 in under 50 ms.

3

We deliver

To your HTTPS URL or your local agent, signed, with retries and a full attempt log.

4

You inspect & replay

Payload viewer, filters per destination, alerts when a delivery is exhausted.

relay-agent · open source

The local agent

A single small program for Linux, macOS and Windows, open source under Apache-2.0. It authenticates with the endpoint's agent key — never with the public URL token — keeps an outbound TLS connection to our gateway and replays each webhook to a URL on your machine or LAN.

  • Reconnects automatically; nothing is lost while it is offline.
  • Reports the real HTTP result of your local app, so the attempt log is honest.
  • Runs as a service: systemd, launchd or Windows Task Scheduler examples included.
  • Rotate the key from the dashboard at any time. Docker image on GHCR.
Agent documentation All releases & checksums
relay-agent — zsh
$ curl -fsSL https://raw.githubusercontent.com/as2expert/relay-agent/main/install.sh | sh
$ relay-agent --key rak_… --forward http://localhost:3000/hooks
INFO relay-agent 0.1.1 starting gateway=wss://relays.as2expert.com/agent
INFO connected to gateway endpoint=Stripe production
INFO forwarded locally delivery_id=5f3a… method=POST http_status=200 latency_ms=12
INFO forwarded locally delivery_id=8c21… method=POST http_status=200 latency_ms=9
WARN local app unreachable, reported to relay delivery_id=9d07… error=connection refused
INFO forwarded locally delivery_id=9d07… method=POST http_status=200 latency_ms=14 attempt=2

Simple monthly plans

Every account starts on Free; upgrade from the dashboard. Payments by Stripe, VAT numbers accepted, invoices issued automatically. Cancel anytime.

Free

0 €/month

Side projects and trying things out.

  • 100 events / month
  • 2 endpoints · 2 destinations each
  • 7-day retention · 256 KiB payloads
  • Retries up to 4 days
  • Local agent · 1 alert channel
Start free

Starter

3 €/month

A shop or a SaaS with one or two integrations.

  • 1,000 events / month
  • 10 endpoints · 5 destinations each
  • 30-day retention · 1 MiB payloads
  • Retries up to 7 days
  • Synchronous responses · 3 alert channels
Choose Starter
Most popular

Pro

9 €/month

Teams that depend on webhooks every day.

  • 10,000 events / month
  • 50 endpoints · 10 destinations each
  • 90-day retention · 5 MiB payloads
  • Retries up to 30 days
  • 10 alert channels · priority support
Choose Pro

Business

29 €/month

High volume, long retention and an SLA.

  • 100,000 events / month
  • Unlimited endpoints · 20 destinations each
  • 1-year retention · 10 MiB payloads
  • Retries up to 30 days
  • 25 alert channels · SLA
Choose Business

Questions

Is the provider's signature preserved?

Yes. We forward the raw body byte-for-byte and the original headers (except hop-by-hop ones), so Stripe, GitHub or Shopify signatures still verify at your end. We add our own X-Relay-Signature on top.

What happens when my server is down?

Deliveries are retried with exponential backoff according to the destination's profile: about 30 minutes, 4 days, 7 days or 30 days depending on your plan. When a delivery is exhausted we notify your alert channels, and you can replay the event from the dashboard at any time within the retention window.

Why do I have to verify a destination?

So nobody can point a relay at a server they do not own. Before an HTTPS destination receives anything, it must echo a one-time token back, or you add a relay-verify TXT record on its domain. Agent destinations are yours by construction and need no verification.

Can the relay reach private addresses?

No. Every hop, including redirects, is resolved and checked against private, loopback, link-local, CGNAT and cloud-metadata ranges, and the connection is pinned to the validated IP. Use the local agent to deliver inside your network.

Where is the data hosted?

On AS2Expert infrastructure in the European Union, with hourly snapshots and a weekly restore drill. Retention is per plan; payloads are deleted afterwards. You can export or delete your whole account from the dashboard.

Ready when your provider is.

Create an endpoint, paste the URL, and see the first webhook land in the dashboard. Free plan, no card.