What is Convoy?
Convoy is an enterprise-grade webhook gateway that manages incoming and outgoing webhooks for developers and engineering teams, handling retries, signatures, rate limiting, and observability. Convoy is built for reliability and scale, combining a control and data plane architecture with PostgreSQL to deliver high availability and durability, and it is available both as a self-hosted install and as Convoy Cloud.
Key Features
- Incoming and outgoing webhook management: Convoy handles both directions of webhook traffic, so teams can send and receive events reliably through a single gateway rather than building separate infrastructure for each.
- Advanced endpoint management: Endpoint controls are designed to improve webhook reliability, security, and performance, helping ensure stable and efficient message delivery to each destination.
- Retries and dispatching: Convoy manages webhook retries and dispatching automatically, removing the operational burden of building and maintaining retry logic in-house.
- Payload signing and verification: Developers can create secrets, sign payloads, and verify events, with rolling secrets available to increase security during secret rotation.
- SSRF protection: Convoy prevents well-known attacks such as Server-Side Request Forgery (SSRF) as part of its security model.
- Rate limiting and observability: The gateway includes rate limiting and observability features for monitoring and controlling webhook delivery.
- Convoy Playground: A free playground lets teams generate webhook URLs, inspect payloads, and analyze headers in one place, making webhook integration testing easier.
- Compliance and access controls: Convoy is SOC2 and GDPR compliant and offers SSO and SAML, private networking, role-based access control, and a 99.999% uptime SLA.
Use Cases
- API-first SaaS teams: Product teams that need to offer outbound webhooks to their customers can use Convoy instead of building a webhooks system internally, as Spruce Health did after determining that matching the required quality and robustness in-house would be highly time-consuming.
- Teams needing fast integration: Companies such as Neynar sent test webhooks within an hour of setup, citing Convoy's dynamic filtering capabilities and ease of setup.
- Engineering teams focused on core product: Teams like Maple adopted Convoy for its retries, signatures, and SDKs so their engineers could concentrate on building the core product.
- Webhook testing and debugging: Developers can use the Convoy Playground to generate webhook URLs, inspect payloads, and analyze headers without standing up their own test infrastructure.
- Security-conscious enterprises: Organizations with compliance requirements can rely on Convoy's SOC2 and GDPR compliance, SSO and SAML support, private networking, and role-based access control.
Who It Is For
Convoy is aimed at developers, platform engineers, and engineering teams at SaaS and enterprise companies who need to send or receive webhooks reliably but do not want to build and maintain that infrastructure themselves. It suits teams that require security features such as payload signing, SSRF protection, and rolling secrets, along with enterprise requirements like SSO, private networking, and compliance certifications.
Pricing
Convoy is available as a self-hosted install via a one-line install script and as a managed Convoy Cloud offering. The source material does not state specific prices; a free playground is available for testing webhook integrations.
Frequently Asked Questions
What is Convoy used for?
Convoy is used to manage incoming and outgoing webhooks reliably. It handles retries, payload signing and verification, rate limiting, and observability so that teams do not have to build and operate their own webhook delivery system.
Is Convoy free?
The source material does not specify free tier or trial terms beyond the free Convoy Playground, which lets users generate webhook URLs, inspect payloads, and analyze headers. Convoy is offered both as a self-hosted install and as Convoy Cloud.
How is Convoy installed?
Convoy can be installed with a one-line command: curl -fsSL https://getconvoy.io/install | bash. Teams can also use Convoy Cloud instead of self-hosting.
What security features does Convoy provide?
Convoy supports payload signing and verification, rolling secrets, and protection against attacks such as Server-Side Request Forgery (SSRF). It is SOC2 and GDPR compliant and offers SSO and SAML, private networking, and role-based access control.
Who should use Convoy?
Convoy is intended for developers and engineering teams that need reliable, secure webhook delivery at scale, particularly those who would otherwise spend significant time building a webhooks system internally. It also fits enterprises with compliance and access-control requirements, backed by a 99.999% uptime SLA.
