Start Building

Webhook infrastructure

Relay webhooks.
Reliably. At scale.

Durelay accepts, verifies, and delivers webhook traffic in milliseconds — then keeps retrying until it lands. One relay layer for every tenant, every destination, every queue.

Start Building View the docs

202 Accept quickly. Deliver durably.

Durelay technical proof points

≤50msp95 accept time
Paralleldestination fan-out
Per-tenantdata isolation
Inbound authHMAC · token · Basic

Why Durelay

Every team rebuilds webhook fan-out. You shouldn’t have to.

Accepting webhooks reliably, fanning them out to every destination a customer configures, retrying the ones that fail, and keeping an inspectable log of what happened — it’s the same plumbing every platform team ends up building from scratch. Durelay is that layer, built once, done right.

How it works

One relay layer. Three durable paths.

Accept once. Choose how each tenant’s traffic moves from there.

01 / Relay Endpoints

One inbound URL. Every outbound destination.

Point a webhook source at a single Durelay URL and fan it out to every destination that needs it — in parallel, with automatic retries on a backoff schedule, and a live delivery log you can inspect and replay from. Your source gets a fast 202 Accepted the moment the request is verified; Durelay handles delivery from there.

↳ Per-destination signing is optional and configurable independently for each destination on the same Relay Endpoint.

deliverieslive
api.customer-a.comdelivered204
hooks.customer-b.ioretrying503
events.internaldelivered200

02 / Queue Endpoints

Turn inbound webhooks into a durable queue.

Every Queue Endpoint gets its own dedicated, isolated queue, so inbound traffic lands somewhere durable instead of straight into your application. Configurable token time-to-live, strict per-tenant isolation, and headroom for payloads up to 100MB when your default limit isn’t enough.

queue / tenant_08isolated
evt_4fe2 · 42 KBevt_4fe1 · 18 KBevt_4fe0 · 64 KB
depth003token ttl12h

03 / Direct Connect

Read the queue on your machine with Durelay Edge.

Short-lived, narrowly scoped credentials that let a client read and write a Queue Endpoint’s queue directly over the wire, so payloads need not pass through Durelay’s relay layer. Durelay Edge is the first-party downloadable client for that path — it runs where your workload already is and hands each message to localhost or a local process.

↳ Custom Direct Connect clients remain valid against the same credentials. Durelay Edge is the first-party client when you want a downloadable path to localhost or a local process.

Edge install how-to
durelay edge
durelay-edge
viadirect connect
targetlocalhost URL
orlocal process
payloadslocal

Security & isolation

Built to isolate. Built to verify.

Standard SaaS-grade security practices, enforced at the request, destination, and tenant boundaries.

01

Authenticated inbound, signed outbound

When Signature required is on, inbound requests authenticate with Durelay HMAC, a static header or token, or Basic Auth before anything else runs. Failed auth returns HTTP 401 with unauthorized. Outbound deliveries can be signed per destination so receivers can verify Durelay as the source.

02

Isolation by default

Every tenant’s configuration, data, and traffic is kept separate at the platform level, not bolted on.

03

Scoped, short-lived credentials

Direct Connect access is narrowly scoped per queue and expires on a schedule you control, not a standing secret — the same model Durelay Edge and custom Direct Connect clients use.

Editions

Start small. Keep the same delivery model.

Feature limits scale with your traffic. Pricing is being finalized.

Durelay Starter, Growth, and Enterprise feature comparison
Compare editions
StarterPricing pendingStart Building
Growth RecommendedPricing pendingStart Building
EnterpriseTalk to usContact Us
Max Relay Endpoints325Unlimited
Max Queue Endpoints110Unlimited
Max destinations per Relay Endpoint310Unlimited
Requests / minute per endpoint60600Negotiated
Requests / month per account100,0002,000,000Negotiated
Max queue token TTL1 hour12 hours24 hours
Log retention7 days30 days90+ days
Large payload add-on (up to 100MB)—Add-onIncluded
Outbound destination signing—IncludedIncluded
Idempotency keys—IncludedIncluded

Developer experience

A few lines, not a few sprints.

Authenticate to one Relay Endpoint (Durelay HMAC shown; static token and Basic Auth are also available). Durelay acknowledges it, creates a delivery, and handles the fan-out from there.

Inbound auth how-to
Illustrative API example (Durelay scheme)
$ curl -X POST \\
  https://api.durelay.com/v1/relay/rel_01HQ7K \\
  -H "X-Durelay-Signature: t=…,v1=…" \\
  -d '{"event":"invoice.paid"}'

HTTP/1.1 202 Accepted
{"deliveryId":"dlv_01J8N4…","status":"accepted"}

FAQ

The details engineers ask first.

What’s the difference between a Relay Endpoint and a Queue Endpoint?

A Relay Endpoint fans a single inbound request out to multiple outbound HTTP destinations. A Queue Endpoint writes the inbound request straight into a dedicated, durable queue instead of calling anything directly.

How do senders authenticate to an Entry URL?

When Signature required is on, choose an inbound auth scheme: Durelay (X-Durelay-Signature HMAC), static header or token, or Basic Auth. Auth failure returns HTTP 401 with unauthorized. Provider-specific inbound HMAC schemes are not available.

Inbound auth how-to

How fast is delivery?

Requests are accepted and authenticated in well under 50ms at the 95th percentile. Fan-out to your destinations happens in parallel afterward, so five destinations resolve about as fast as one.

What happens if a destination is down?

Durelay retries automatically on a backoff schedule and keeps a live, inspectable log with manual retry available for anything that still fails.

Is my data isolated from other tenants?

Yes. Isolation is enforced at the platform level for every tenant, by default.

Can I skip the relay and connect directly to my queue?

Yes. Direct Connect issues short-lived, scoped credentials so your application can read and write a Queue Endpoint’s queue directly. Durelay Edge is the first-party client for that path: it runs on your machine and delivers messages to a local URL or process. Custom Direct Connect clients use the same credential model.

Edge install how-to

What is Durelay Edge?

Durelay Edge is Durelay’s downloadable Direct Connect client. It consumes one Queue Endpoint and delivers each message to a target on the same machine — typically a localhost HTTP URL, or a local process — so payloads stay off the relay path.

Edge install how-to

The relay layer is ready

Stop rebuilding webhook plumbing.

Start Building