Question 1

What is a webhook gateway?

Accepted Answer

A webhook gateway is a single entry point that receives webhooks from third-party providers, verifies each one, and routes it to the right internal service. Instead of exposing a public endpoint per app and duplicating signature-checking code everywhere, you centralize verification, routing, and secrets in one place. With ngrok that entry point delivers events into your private network over an outbound-only tunnel, so nothing is exposed to the internet.

Question 2

Webhook vs. API: what's the difference?

Accepted Answer

With an API you poll: your app repeatedly asks a service "anything new?" and burns requests against rate limits. A webhook is push, so the provider sends you an HTTP request the moment an event happens. A webhook gateway is what receives those pushes safely. Moving from polling to webhooks is usually what removes the API rate-limit pain in the first place.

Question 3

Can I receive webhooks on a service behind a firewall or on-prem?

Accepted Answer

Yes. Run the ngrok agent next to your on-prem service: an internal Jenkins server, CI runner, or private API. It dials out to ngrok on port 443, and providers deliver to your ngrok endpoint. ngrok routes the event back down that outbound tunnel to your service. You never open an inbound firewall port or assign a public IP. See the webhooks to on-prem guide.

Question 4

How does webhook signature verification work?

Accepted Answer

ngrok validates the provider's signature at the edge for 70+ providers before the request reaches your compute. You store each provider's signing secret in an encrypted vault and reference it from a Traffic Policy. ngrok automatically rejects requests that fail verification, including spoofed and tampered payloads. See the webhook gateway example.

Question 5

Which webhook providers are supported?

Accepted Answer

ngrok verifies signatures for 70+ providers out of the box, including Stripe, GitHub, Bitbucket, Twilio, Slack, and Shopify. Because Traffic Policy handles the routing, you can front any other provider that sends HTTP webhooks.

Question 6

Can I send Bitbucket or GitHub webhooks to an on-prem Jenkins?

Accepted Answer

Yes, and it's one of the most common patterns. Instead of polling your Git host (and hitting rate limits) or exposing Jenkins to the internet, run the agent next to Jenkins. Bitbucket or GitHub deliver push and PR events to ngrok, ngrok verifies the signature at the edge, and the event triggers your pipeline over the outbound tunnel. No inbound firewall rule required.

Question 7

How is this different from Hookdeck or Svix?

Accepted Answer

Hookdeck and Svix are cloud webhook-infrastructure platforms: they receive events in their cloud and then forward them to a destination that's reachable from the internet. ngrok's difference is where the event lands. It delivers directly into your private network through an outbound-only agent, with no public receiver to stand up or defend. That's the case ngrok is built for: a receiver that runs on-prem or behind a firewall, and that you don't want to expose. If you need a cloud-hosted durable queue with heavy retry tooling, evaluate both against your delivery-guarantee requirements.

Question 8

Do I need to open any inbound firewall ports?

Accepted Answer

No. The ngrok agent establishes the tunnel with outbound TLS connections to the ngrok cloud on port 443, the same port as normal HTTPS traffic. Most firewalls allow this by default, so there's nothing inbound to open and no public IP to expose.

Question 9

Will this help with API rate limits from polling?

Accepted Answer

Yes. Teams that poll a SaaS API on a timer to detect changes routinely hit rate limits, and their data lags behind. Webhooks flip that around: the provider notifies you exactly when something happens, so you drop the repeated polling calls and the rate-limit backoff, and events arrive in near real time.

Question 10

Is it compliant enough for regulated webhook data?

Accepted Answer

ngrok is SOC 2 Type II, HIPAA/BAA, GDPR, CCPA, and EU-US DPF covered. You get audit logs, and you can pin traffic to specific regions to meet data residency requirements. Find the full documentation and audit reports at trust.ngrok.com.

Question 11

Is a webhook gateway the same as site-to-site connectivity?

Accepted Answer

They share the same secure-tunnel foundation. A webhook gateway is the inbound, event-driven case: verifying and routing provider webhooks to a private service. If you also need your own cloud software to reach services inside another network, see site-to-site connectivity.

Question 12

How is the webhook gateway priced?

Accepted Answer

You only pay for what you use. Pricing is based on how often your endpoints are active, the traffic you push through ngrok, the number of Traffic Policy executions, and more. See full pricing on the ngrok pricing page.

Deliver webhooks to services behind your firewall. Nix the inbound ports.

Pipe every provider into your private network.

policy.yml

Why ngrok?

Pass the audit before the webhook ever reaches you.

Reject spoofed webhooks with cryptographic verification

No open inbound ports, ever

Layer on IP restrictions, mTLS, and JWTs

Keep regulated payloads in-region

All the boxes your security review needs

Don't drop the events you can't replay.

Reconnect automatically

See every event and its outcome

High availability with redundant agents

Stay online during region outages

From one webhook to your whole event pipeline.

Deploy the agent anywhere

Config, not code