Custom sources
Connect anything that sends signed JSON webhooks, such as Stripe, Shopify, Paddle, Clerk, or Resend, and watch it with your own rules.
These pages describe ShellOrbit as it runs today. Breaking changes to the HTTP API are announced before they ship, and existing request and response shapes stay supported.
A custom source takes any JSON webhook, checks its signature, keeps it, and runs your custom rules over it. Use it for a system without a ready-made kind.
Set it up
- In Settings, Integrations, Add source, choose Custom.
- Choose the signature format the sender uses, and paste the sender’s signing secret:
| Format | Senders | Header checked |
|---|---|---|
| Stripe | Stripe | Stripe-Signature |
| Shopify | Shopify | X-Shopify-Hmac-Sha256 |
| Paddle | Paddle | Paddle-Signature |
| GitHub | GitHub, and senders that copy its scheme | X-Hub-Signature-256 |
| Standard Webhooks | Svix and products built on it, such as Clerk, Resend, and Dodo Payments | webhook-signature, or svix-signature |
| ShellOrbit | Your own systems | ShellOrbit-Signature |
- Paste the source URL into the sender as its webhook URL.
- Add rules for what matters. Without one, events are kept and nothing raises a finding.
See signature verification for each format.
Rule ideas
| Sender | Rule |
|---|---|
| Stripe | body.type equals account.updated, high: account details changed |
| Stripe | body.type equals charge.dispute.created, more than 5 in 60 minutes, high |
| Clerk | body.type equals user.deleted, more than 20 in 10 minutes, high |
| Shopify | header.X-Shopify-Topic equals app/uninstalled, medium |
Custom rules are on Starter (10), Pro (50), and Business (unlimited).