This project is not covered by Drupal’s security advisory policy.
Connector Hub is a reusable core for talking to external systems from Drupal: payment providers, PEPPOL (e-invoicing), CRMs, ERPs, or anything else with an outbound API call and an inbound webhook. Rather than one more single-purpose integration module, it is the layer those integrations get built on top of, so each one stops reinventing retries, secret handling, authentication and endpoint configuration from scratch.
The core is small on purpose:
- A
ConnectorEndpointconfig entity: one instance per integration, holding which plugin it uses, its secret (via the Key module, never in exported configuration), and whether inbound and/or outbound is enabled. - A
Connectorplugin system (PHP attributes) that any module can extend to add its own integration, without touching the core. - An outbound dispatcher that queues calls through Drupal's own Queue API, so a failing remote endpoint retries instead of losing the call.
- An authenticated, generic inbound webhook route with a secret path token, HMAC or Bearer verification, rate limiting on failed attempts, and durable, deduplicated, retried processing: a webhook call is queued the moment it is verified, never processed inline, and a duplicate delivery from a retrying provider is recognized and short-circuited rather than handled twice.
- A per-endpoint health dashboard in the admin UI, showing last success, last failure and a live failure streak per integration, so a broken connection is visible before a user reports it.
The provider adapters already built on top of this core (Mollie, Stripe, MultiSafepay and Buckaroo, in the separate connector_hub_payment project) exist to prove the contracts hold up against real, differently-shaped APIs, not as the main product in themselves. A minimal working example (create an order, start a payment, react to its outcome) ships alongside them for anyone building their own integration to read first.
Full architecture walkthrough, diagrams and the reasoning behind the design decisions: connector-hub.porschmann.be.
Additional Requirements
Drupal core ^10.3 || ^11.0.
The Key module (required). All secrets (API keys, HMAC secrets, Bearer tokens) are stored through Key, never in exported configuration.
Recommended modules/libraries
None beyond Key at this time. Specific integrations (payment providers, PEPPOL, CRM, ERP, ...) are intended to ship as separate, optional modules that depend on Connector Hub and add their own Connector plugin.
Similar projects
- Entity Webhook is the closest match: it also covers inbound and outbound webhooks with queued, retried delivery. Its inbound side is tightly coupled to creating/updating Drupal entities from JSON via JSONPath mapping. Connector Hub deliberately stays entity-agnostic on inbound, it only validates and dispatches an event, so the same core can sit under payment, PEPPOL, CRM or ERP integrations that don't necessarily map 1:1 onto a Drupal entity.
- Webhooks acts as a generic dispatcher/receiver and stores every received webhook as an entity, but has no plugin system per external integration and no built-in secret-management model.
- Webhook Receiver is plugin-oriented like Connector Hub, but inbound-only: no outbound dispatcher, queue-based retries, or endpoint configuration entity.
Connector Hub's focus is the reusable core: a ConnectorEndpoint config entity, a Connector plugin interface, a queued outbound dispatcher, and an authenticated generic webhook route, with actual system-specific logic (payment, PEPPOL, CRM, ERP) added as separate plugins rather than built into the core.
Supporting this Module
No sponsorship links at this time.
Community Documentation
See connector-hub.porschmann.be for the full architecture walkthrough, or the module's README.md in the repository for how to add a new Connector plugin.
Project information
Seeking co-maintainer(s)
Maintainers are looking for help reviewing issues.- Ecosystem: Drupal core
- Created by mookum on , updated
This project is not covered by the security advisory policy.
Use at your own risk! It may have publicly disclosed vulnerabilities.
