Official package · Frameworks

Realtime for Spring Boot, the Spring way

A starter that injects a Hibira client, authorizes private and presence channels with annotated bean methods and turns webhooks into application events. Browsers and apps connect with pusher-js, Laravel Echo or the mobile Pusher SDKs; no WebSocket server or STOMP broker to run.

hibira-spring-boot-starterMaven Central ↗GitHub ↗

• @HibiraChannel authorizes channels with the user from Spring Security, and the starter serves the auth endpoints pusher-js calls, on Spring MVC or WebFlux.
• @HibiraBroadcast sends an application event to browsers after the transaction commits, and webhooks arrive as WebhookEvent for @EventListener.
• The client also sends to the notification inbox, publishes push notifications and asks for approvals. Spring Boot 3 and 4, Java 17 and later; hibira-java works without Spring.

Sign in to see these snippets with your own cluster host. Sign in

1. Install

   <dependency>
     <groupId>io.hibira</groupId>
     <artifactId>hibira-spring-boot-starter</artifactId>
     <version>0.1.0</version>
   </dependency>
   
   <!-- environment -->
   HIBIRA_APP_ID=YOUR_APP_ID
   HIBIRA_KEY=YOUR_APP_KEY
   HIBIRA_SECRET=YOUR_APP_SECRET
   HIBIRA_HOST=ws.hibira.io

2. Set it up

   @Component
   class Channels {
       @HibiraChannel("private-orders.{orderId}")
       boolean order(Principal user, long orderId) {
           return orders.isOwner(orderId, user.getName());
       }
   }
   
   @HibiraBroadcast(channels = "private-orders.#{orderId}", event = "order.shipped")
   record OrderShipped(long orderId, String carrier) {}
   
   // in a @Transactional service: sent once the transaction commits
   events.publishEvent(new OrderShipped(1042, "DHL"));
   hibira.trigger("orders", "order.created", Map.of("id", 1042)); // or send directly

3. Use it

   const pusher = new Pusher('YOUR_APP_KEY', {
     wsHost: 'ws.hibira.io',
     cluster: '',
     enabledTransports: ['ws', 'wss'],
     channelAuthorization: { endpoint: '/hibira/auth', headers: { 'X-XSRF-TOKEN': csrfToken } },
     userAuthentication: { endpoint: '/hibira/user-auth', headers: { 'X-XSRF-TOKEN': csrfToken } },
   });
   pusher.signin(); // hibira.sendToUser(...) reaches this tab
   pusher.subscribe('private-orders.1042').bind('order.shipped', (order) => console.log(order));

Before you start

• The app secret is shown only once, when you create the app or rotate its secret. Keep it on your server, never in a browser or game build.
• With Spring Security, send the CSRF token from the browser (or exempt /hibira/auth and /hibira/user-auth), and let /hibira/webhooks through without a session or CSRF token: it checks the signature itself.
• On the Free plan, list every origin your pages load from in the app’s allowed origins (http://localhost:8080 while developing, then your domain). "*" needs a paid plan.

Use the app key from your dashboard; the secret stays on your server. Channels, events and authorization endpoints work exactly as they do with Pusher. Create your free account →