Webhook hosting: an https endpoint that answers when they call
A webhook receiver is a small web app with a public https address and a valid certificate that is up when the sender calls. That is exactly what an app with a web address is here: https://name.fadehost.app, HTTPS handled, deployed from GitHub.
What senders require
- HTTPS with a certificate a browser trusts (self-signed is refused by most senders). Included.
- A fast 2xx answer: do the work after replying. A queue in Redis is one click away for heavy jobs.
- Signature checks: GitHub's X-Hub-Signature-256, Stripe's Stripe-Signature, Meta's X-Hub-Signature-256, Discord's Ed25519 header. The WhatsApp template shows the HMAC pattern.
- Ports: senders call 443. Your app listens on the PORT variable and the address routes to it.
Free or paid
A free app's address sleeps when nobody opens it and wakes on the next request; senders that retry (GitHub, Stripe, Meta) tolerate the first slow call, but a receiver people rely on wants the always-on address: $2 a month on a paid tier, next to the tier's own price.
Typical receivers
- GitHub push events that trigger a script
- Stripe or Paddle payment events that update a database
- Discord interaction endpoints for HTTP-only bots
- Telegram bots in webhook mode, WhatsApp Cloud API bots
- Uptime and alert receivers that post into chat
Frequently asked questions
Do I get a custom domain?
Every app gets name.fadehost.app. Custom domains for apps are on the roadmap; game servers already support them.
Can the receiver run a long job?
Reply first, then work: queue the job in Redis or run it in the same process after the response. Apps run around the clock on paid tiers.
How do I verify signatures?
Each sender documents its header; the WhatsApp template verifies X-Hub-Signature-256 with a timing-safe compare and is a good starting point for the others.
Is there a request log?
Whatever the app prints appears in the live console; log the events you care about.