~/webhook api tester json diff logs ☕ Support me apps ← about me
// private endpoint on your own cloudflare worker · live capture · signature check · replay

Webhook Tester & Inspector — capture, inspect, verify and replay HTTP requests

Get a private webhook URL on a free Cloudflare Worker in your own account, point GitHub, Stripe, Slack or Shopify at it and watch requests arrive live. Read every header, the formatted body and query parameters, verify the HMAC signature with your secret, set a custom response, and replay a request to your own server or copy it as cURL. Or explore with demo data first.

Connect your endpoint

  1. Sign in to the Cloudflare dashboard (the free plan is enough) and open Workers & Pages → Create → Worker. Name it, for example webhook, and deploy the hello-world version.
  2. Go to Storage & Databases → KV, create a namespace called WEBHOOK_STORE.
  3. In your Worker, open Bindings → Add → KV namespace: variable name WEBHOOK_STORE, pick the namespace.
  4. Edit code, replace everything with the code below, and press Deploy.
  5. Paste the Worker's address (like https://webhook.yourname.workers.dev) here and connect.
Worker code (v2, works with endpoints made by the old version)
Paste it in the Cloudflare editor.

  












  
Guide — debug a webhook in five steps

  
Requests are stored in your own Cloudflare Worker; this page only reads them.

  

    
1Deploy the Worker once
Create a free Worker in your Cloudflare account, bind a KV namespace named WEBHOOK_STORE, paste the code and deploy. About five minutes. Or press Try the demo first.

    
2Copy your URL
The page creates a private endpoint like /h/3f9c…. Paste it into the webhook settings of GitHub, Stripe, Slack, Shopify or your own app.

    
3Watch requests arrive
New requests appear within seconds. Filter by method, search, and open one to see the headers, the formatted JSON or form body and the query string.

    
4Verify the signature
Enter the signing secret and check the HMAC exactly as your server should: GitHub, Stripe, Slack, Shopify, Standard Webhooks or any other HMAC header.

    
5Replay or reproduce
Send the same request to your staging server, copy it as cURL, or make your endpoint answer with an error or a delay to test retries.

  

  
What it does

  

    
CAPTUREEvery detail
Any method, any sub-path.
Request
Method, path, query, headers, body, IP, country
Bodies
JSON, forms, XML, text, binary
Sources
Recognises GitHub, Stripe, Slack, Shopify, GitLab, Twilio

    
CHECKSignatures
Recomputed in your browser with WebCrypto.
GitHub
X-Hub-Signature-256
Stripe
Stripe-Signature with timestamp
Others
Slack, Shopify, Svix and custom HMAC

    
TESTYour side
See how both ends behave.
Response
Custom status, body and delay
Replay
To any URL, or as cURL
Send
Test requests from the page

  







Webhook testing, explained


A webhook is an HTTP request that one service sends to another when something happens: GitHub when code is pushed, Stripe when a payment succeeds, Shopify when an order is created. To build the receiving side you need to see exactly what arrives. A webhook tester gives you a URL that captures those requests so you can inspect them before (or instead of) writing your handler.



Why your own Worker instead of a shared service?


Services like webhook.site and RequestBin receive your requests on their shared servers, which means customer data, tokens and payment events pass through a third party. Here the endpoint runs as a Cloudflare Worker in your own account and stores requests in your own KV namespace. This page talks only to your Worker, from your browser. The Worker code is short enough to read before you deploy it.



Verifying webhook signatures


Anyone who knows your webhook URL can send requests to it, so providers sign each request with a secret only you and they know. Your server must recompute the signature over the raw body and compare it in constant time:




ProviderHeaderSigned contentFormat


GitHubX-Hub-Signature-256bodysha256= + hex HMAC-SHA256


StripeStripe-Signaturetimestamp + "." + bodyt=…,v1= hex HMAC-SHA256


SlackX-Slack-Signature"v0:" + timestamp + ":" + bodyv0= + hex HMAC-SHA256


ShopifyX-Shopify-Hmac-Sha256bodybase64 HMAC-SHA256


Standard Webhooks / Svixwebhook-signatureid + "." + timestamp + "." + bodyv1, + base64, secret is base64 (whsec_)




The most common bug is verifying a re-serialised body: frameworks that parse JSON first and stringify it again change spaces and key order, so the signature never matches. Read the raw bytes. Also reject old timestamps, so a captured request can't be replayed later.



Testing retries and failures


Providers treat anything other than a 2xx response, or no answer within their timeout (ten seconds for GitHub), as a failed delivery. Stripe then retries for up to three days; GitHub marks the delivery as failed and lets you redeliver it from the webhook settings. Set a custom response of 500 or a delay to see what the provider does, then switch back to 200. Webhooks can also arrive more than once or out of order, so handlers should be idempotent: store the event or delivery ID and ignore duplicates.



Replay and local development


Once you have captured a real request, you can send it again to your development server instead of triggering a new event each time. Replay from the page works when your server allows cross-origin requests; otherwise copy the request as cURL and run it in a terminal. To receive webhooks on your own laptop directly, use a tunnel such as Cloudflare Tunnel or ngrok, or the provider's own CLI (the Stripe CLI can forward events to localhost).



Privacy and limits


Captured requests live in your KV namespace: the latest 100 per endpoint, deleted automatically seven days after the last request. Endpoint IDs are random and unguessable, but anyone with the URL can send to it and read it through your Worker, so treat the URL as a secret and create a new endpoint when you are done. Signing secrets you enter for verification stay in this browser's local storage and are never sent anywhere. Cloudflare's free plan allows 100,000 Worker requests and 1,000 KV writes per day.