Why SFHooks

Webhook infrastructure you don't have to babysit

The hard parts of event delivery — reliability, trust, and visibility — handled for you, so a missed Salesforce change never becomes a 2am incident.

Delivered, not dropped

At-least-once delivery with jittered retries up to 31 attempts. When an endpoint is down, events wait in a dead-letter queue — replay them in one click once it's back.

Signed, so you can trust it

Every payload is HMAC-SHA256 signed. Verify it in four lines, reject anything that doesn't match, and rotate signing secrets with zero dropped deliveries.

Observable to the millisecond

Live success rate, p95 latency, and per-webhook health. Every event keeps its full delivery history — payload, attempts, and response codes — for fast debugging.

Trust, verified

Confirm every delivery in four lines

SFHooks sends a timestamp and an X-SFHooks-Signature header with each request. Recompute the HMAC over the raw body and compare in constant time — that's the whole integration.

No SDK required — standard HMAC-SHA256 in any language.
Stale-timestamp rejection guards against replays.
Multiple signatures during rotation — swap secrets anytime.

verify.js

import crypto from "node:crypto"

// verify BEFORE JSON.parse — sign the exact bytes you got
function verify(rawBody, headers, secret) {
  const ts  = headers["x-sfhooks-timestamp"]
  const sig = headers["x-sfhooks-signature"] // t=…,v1=…

  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${ts}.${rawBody}`)
    .digest("hex")

  // any v1 may match during a secret rotation
  return sig.split(",")
    .filter(p => p.startsWith("v1="))
    .some(p => crypto.timingSafeEqual(
      Buffer.from(p.slice(3)), Buffer.from(expected)))
}

Everything in the box

From first connection to production scale

Connect a Salesforce org, point a webhook at your endpoint, and you're streaming. Reach for the advanced controls when you need them.

Connect any org

OAuth into Salesforce and subscribe to Change Data Capture — tokens encrypted at rest, refreshed automatically.

Field & payload filtersScale

Deliver only what matters — by changed field, or by value with eq/gt/lt operators and AND/OR logic.

Custom headersPro

Attach auth tokens or tenant ids to every delivery. Reserved signing headers stay protected.

Health & auto-pause

Endpoints escalate healthy → degraded → failing → paused so one bad receiver can't drown your queue.

Roles & accessScale

Invite your team with owner, admin, member, and read-only roles. Read-only means read-only.

Replay from the DLQScale

Inspect terminally-failed events and re-deliver one — or all — once your endpoint recovers.

Mission control

The whole pipeline, on one screen

Throughput, latency, and delivery health at a glance — then drill into any event's payload and attempts.

dashboard.sfhooks.com

Success rate

99.4%

p95 latency

48 ms

Deliveries · 24h

18,204

Recent deliverieslive

14:02:55.214	Account	updated	200 OK	41 ms
14:02:54.881	Invoice__c	created	200 OK	52 ms
14:02:54.503	Opportunity	updated	retry 2	—

Pricing

Start free. Scale when you do.

Every plan includes signed delivery, automatic retries, and the full dashboard. Pick the tier that fits your volume.

Starter

$49 / mo

Get production webhooks off the ground.

100K events / month
5 webhooks · 1 connection
HMAC signing & retries
7-day log retention

Start 14-day trial

Need more than Scale?

Talk to us about higher event volumes, multiple Salesforce orgs, SSO/SAML, custom retention windows, SLAs, and dedicated support — we'll tailor a plan to your throughput.

Talk to sales Or email [email protected]

Ship your first signed webhook today

Connect Salesforce, point a webhook at your endpoint, and watch the first delivery land. Most teams are live in under ten minutes.

Start your 14-day trial Read the docs