Webhook Toolkit

Create a public HTTPS URL that captures every HTTP request sent to it (any method, any sub-path). Use it when you need an endpoint to receive a webhook from a third-party service (Stripe, GitHub, Shopify, Slack, Twilio, Clerk…) or from the app you are testing, without deploying or tunnelling anything. Returns the URL, the token the other tools take, and a web inspector link. Anonymous URLs expire after 7 days. Next: configure the sender with the URL, trigger the event, then call wait_for_webhook.

AI analysis of a captured webhook: what the event means, its key fields, how its signature is verified and common pitfalls; or, with mode 'handler', a ready-to-use handler in node, python, php, go or ruby. Use it on an unfamiliar payload. Needs WEBHOOK_TOOLKIT_KEY; paid feature with 3 free trials.

Get one captured request in full: method, path, query, all headers, raw body (as received, byte-exact for signature checks), detected provider and event. Use it to inspect a payload before writing or fixing a handler.

List the requests captured by a webhook URL, newest first, with method, path, detected provider/event, size and a short body preview. Use it to see what a service actually sent, then get_webhook_request for one in full.

List the webhook URLs owned by the account behind WEBHOOK_TOOLKIT_KEY (required). Use it to find the token of an existing permanent URL instead of creating a new one.

Re-send a captured webhook FROM THIS MACHINE to a URL, localhost included (e.g. http://localhost:3000/api/webhooks), with the same method, headers and body. Use it to iterate on a webhook handler without re-triggering the real event. Returns the handler's status, latency and response. The captured sub-path and query are appended to target_url. Timestamped signatures (Stripe, Slack, Svix, Paddle) are replayed as captured, so strict handlers reject them after ~5 minutes: then use send_signed_webhook.

Build a webhook with a valid provider signature (Stripe, GitHub, Shopify, Slack, Twilio, Mailgun, Svix/Clerk/Resend, Paddle, Discord with a test key) and POST it FROM THIS MACHINE to your handler (localhost works). Use it to test signature verification and event handling without the real provider. Returns the handler's status and response. Signing happens locally: the secret never leaves the machine.

Change what a webhook URL answers to senders: status code, body and content type (and optionally its name). Use it to simulate a failing endpoint (e.g. 500 so the provider retries) or to answer a verification challenge that expects a specific body. URLs created with an API key can only be changed with that key.

Compute valid signature headers for a webhook body without sending it. Use it to write a test fixture, a curl command, or to check what a provider's signature should be for a given secret. Returns headers, body and a curl command. Runs locally.

Check whether a webhook signature is valid and, when it is not, explain why: wrong secret, body modified before verification (JSON re-serialised by a parser, trailing newline, CRLF), whitespace in the secret, expired timestamp, or for Twilio the URL form (http vs https, port, query, trailing slash). Use it when a handler rejects deliveries with 'invalid signature'. Runs locally: the secret never leaves the machine.

Block until a webhook reaches a capture URL, then return it (method, path, headers, raw body, detected provider and event type). Use it right after triggering the action that sends the webhook. It is safe to call after the webhook was already sent: requests received since the URL was created in this session, or since the last request this tool returned for the token, are included. Filters skip unrelated deliveries. Calling it again returns the next request. A timeout means nothing matching arrived: check the sender's configuration, then call again.