sarathsp06/sparrow

Self-hosted webhook delivery platform with async fan-out, HMAC signing, Go-template payload transforms, and automatic retries

Summary

Sparrow is a self-hosted webhooks-as-a-service written in Go. It provides asynchronous delivery, retries, Standard Webhooks signing, Go-template payload transformations, endpoint health tracking, delivery history, and a consumer portal, with PostgreSQL as its only runtime dependency.

What it is useful for

Use Sparrow when an application needs to publish events such as order.created to several HTTP endpoints without building its own queue, retry logic, signing system, or delivery dashboard.

It is particularly relevant for:

• Reliable fan-out: Sparrow supports at-least-once delivery, backoff-based retries, per-webhook rate limits, 429-aware snoozing, and bulk re-push or retry.
• Receiver security: Deliveries can use HMAC-SHA256 or optional Ed25519 signatures in Standard Webhooks format. Secrets and sensitive headers are envelope-encrypted at rest, and outbound requests have SSRF protection.
• Payload shaping: Per-subscription Go templates can reshape event payloads. The README also documents YAML recipes for destinations such as Slack, Discord, PagerDuty, Twilio, SendGrid, and CloudEvents.
• Operations: Teams can inspect endpoint health, request and response history, OpenTelemetry traces, metrics, and logs. Receivers that repeatedly fail can be paused automatically.
• Multi-tenant workflows: A token-scoped portal lets customers register endpoints and inspect or retry their own deliveries.
• Event evolution: Event types can be versioned, while soft schema validation warns about mismatches instead of dropping events.

One important semantic limitation is that delivery is at-least-once, not exactly-once. Also, schema validation is intentionally non-blocking, so warnings still need attention.

How engineers can use it

The README documents a local Docker Compose setup with no clone required:

curl -O https://raw.githubusercontent.com/sarathsp06/sparrow/main/deploy/docker-compose.yml
docker compose up -d

The dashboard is then available at http://localhost:8080, with an interactive API reference at http://localhost:8080/docs. Engineers can register event types and webhooks, push a test event, and inspect delivery attempts from the dashboard. If port 8080 is occupied:

SPARROW_PORT=8090 docker compose up -d

For a local event flow, install the macOS/Linux CLI using the documented checksum-verifying installer:

curl -fsSL https://raw.githubusercontent.com/sarathsp06/sparrow/main/scripts/install.sh | sh
sparrow init --url http://localhost:8080
sparrow listen --event order.created

In another terminal:

sparrow push order.created -d '{"order_id":"ord_1","amount":42}'

For production use, follow the README’s Production Deployment guide first: the supplied Compose setup is intentionally open and local-only. The OpenAPI 3.1 specification is also committed in the repository for generating clients or integrating through curl.