HookGet Open dashboard

Connecting a source

Every connector is one credential and one API call. This page is the whole of it: which credential each provider needs, where to create it, what HookGet does with it, and what to look at when something fails.

In short

  • Push sources: we give you a secret (or you paste the provider’s public key), you paste it into their webhook settings. Done.
  • Pull sources: you paste one credential — an access token or a service-account JSON key — and choose an interval. The first sync runs immediately.
  • Credentials are encrypted at rest, used only at sync time, and returned by no route.
  • Health is per source, in words: auth_failed, rate_limited, ok: 41 new, 3 already seen.
  • Everything here is one POST /v1/sources — no OAuth redirect flows, no browser dance.

The credential, provider by provider

ProviderWhat you pasteWhere you get itScope it needs
Stripenothing — we generate the secretpaste ours into Stripe → Webhooksthe events you select in Stripe
SendGridtheir verification key (public)Settings → Mail Settings → Event Webhook
GoHighLeveltheir public key (PEM)GHL developer docs
Postmarknothing — we generate the tokenpaste as basic-auth password on the webhook
n8nnothing — we generate the tokenadd as a header on your HTTP Request node
OpenAIan organization admin keyOpenAI console → organization settingsusage + costs (read)
Anthropican Admin API keyAnthropic consoleusage + cost reports (read)
Google Analytics 4a service-account JSON keyGoogle Cloud consoleViewer on the GA4 property
Search Consolethe same JSON key worksGoogle Cloud consoleuser on the Search Console property
Meta Adsa system-user access tokenBusiness settings → System usersads_read
TikTok Adsan access tokenAds Manager → API accessreporting (read)

When something fails

You seeIt meansWhat to do
auth_failed healththe provider rejected the credentialcreate a fresh one, update the source, resume — the cursor is kept
rate_limited healththe provider throttled usnothing — the sync backs off exactly as long as the provider asked
a paused source you did not pause20 consecutive failuresfix the credential, resume; the failure count and backoff reset
401 on /ingest/… in provider logstheir signature did not verifyusually a rotated secret — rotate on our side too; both verify during the overlap
events with the provider’s own namesthe source predates canonical naming, or the type is unmappedexpected — nothing is dropped; see the source page for the mapping
One scheduled sync of a pull source The scheduler claims a due source, fetches from the provider's API with the saved cursor, normalises the response into events, and stores them. Only when the sync succeeds does the cursor advance. A failure keeps the old cursor and retries with a growing backoff; after twenty consecutive failures the source pauses and reports its health. Due interval passed Fetch from the saved cursor Normalise dedupe on provider ids Stored, cursor advances only on success — never mid-failure Failure: old cursor kept backoff doubles · 20 strikes → paused, health says why
The two rules that make polling safe: the cursor advances only on success (a partial read never silently skips events — re-reads deduplicate for free), and a failing credential backs off and eventually pauses instead of hammering the provider in your name.

Questions

Where do credentials live, and who can read them back?

Every credential — generated secret, access token, service-account key — is encrypted with AES-256-GCM before it touches the database, is decrypted only at the moment of use, and is returned by no API route. A generated secret is shown exactly once, at creation. Lost one? Rotate: the new secret is issued and the old keeps verifying until the overlap window closes, so rotation is never an outage.

What does source health actually tell me?

A machine-stable code and a human sentence: auth_failed: meta: Error validating access token, rate_limited, unreachable. It is set by every sync, visible on the source, and honest — a source that has failed twenty syncs in a row pauses itself and says so, rather than pretending to be connected.

Can a connector see data from another project?

No, structurally. The project an event lands in comes from the source row itself — never from anything in a payload or a provider response. The envelope builder refuses tenant-shaped fields in event attributes outright, and the isolation suite tries the cross-tenant paths on every build.

What happens on my side when I revoke a credential at the provider?

The next sync fails with auth_failed, the source backs off and then pauses. Nothing retries forever. When you paste a new credential and resume, the failure count clears and reading continues from the saved cursor — no gap, no duplicates.

Do I need a separate HookGet plan for sources?

No. Source events meter exactly like published events — the 64KB unit rule, counted at fan-out — and appear in the same usage view. A source with no subscribed destination stores events but fans out to nobody, and a delivery that did not happen is not billed.