Webhook Tester

Server assisted API Testing

Generate a temporary endpoint, point your webhook provider at it, and watch requests arrive with full headers, query parameters, raw and formatted bodies. The URL stays usable for 24 hours; each captured request is deleted two hours after it arrives.

Privacy: Captured requests are held on the Mutqan backend for two hours and then deleted. The capture URL itself expires at most 24 hours after it is created; the SMS Delivery Inspector deletes its URL when you leave, reload or close the page, as the other capture tools do when the browser blocks session storage. No mailbox or address is created for you. Credentials such as Authorization headers are never stored. Do not point production traffic containing personal data at it.

What is a webhook?

A webhook is an HTTP request a service sends to a URL you register when something happens — a payment settles, a message is delivered, a build finishes — so your system reacts to events instead of polling. Testing one means capturing what is actually sent (method, headers, body), checking retries and ordering, and verifying the signature that proves the call came from the sender.

Security note: A webhook endpoint is a public URL anyone can post to. Verify the sender's signature (usually an HMAC over the raw body) with a constant-time comparison, reject stale timestamps, and treat the payload as untrusted input.

Read the guide: What is API Testing? How to Test a REST API

How to use Webhook Tester

  1. Press "Create capture URL" and copy the URL.
  2. Configure it as the webhook destination in your provider (or send a request with cURL / the sample command).
  3. Wait a moment — deliveries appear in the list; click one to inspect it.
  4. Use the Replay tab to build a cURL command that resends the delivery to your own server.
  5. Delete the endpoint when you are done (or let it expire).
The provider calls the capture URL, not this page: the page polls for deliveries, and Replay only hands you a cURL command that you run against your own server.
  • Webhook provider e.g. Stripe
  • Capture service capture URL + API
  • This page your browser
  • You and your server terminal, handler
  1. 1 From This page To Capture service: Create capture URL POST /api/v1/webhooks
  2. 2 From Capture service To This page: Capture URL and a private token reply Kept in this browser session, so a refresh keeps it https://www.mutqansoft.sa/hooks/3f9c…
  3. 3 From You and your server To Webhook provider: Set it as the webhook destination Or send a request yourself with cURL
  4. 4 From Webhook provider To Capture service: An event happens: the provider POSTs it Headers including the signature, and a JSON body Stripe-Signature: t=1725184801,v1=…
  5. 5 From Capture service To Webhook provider: 200 OK reply With a small JSON body, which satisfies most delivery checks
  6. 6 From This page To Capture service: Asks for new deliveries Every 3 s while the tab is visible, with the token GET /api/v1/webhooks/:id/requests
  7. 7 From Capture service To This page: New deliveries appear in the list reply Method, path, headers (credentials as [redacted]), body, size and time
  8. 8 From This page To You and your server: Replay tab builds a cURL command Provider headers and signature kept
  9. 9 You and your server internally: You run it against your server Put back any [redacted] credential your handler checks

Stripe is the example provider. The capture URL expires after 24 hours, or earlier when you delete the endpoint. Replayed later, a timestamped signature (Stripe, Slack) fails the usual 5-minute tolerance check.

Webhook Tester features

  • Unique capture URL created in one click, remembered across page refreshes, expiring after 24 h
  • Live polling every 3 s while the tab is visible; "Waiting for incoming request…" empty state
  • Request list with method, path, time and size; detail view with summary, grouped headers, body (JSON/form/raw/tree), query, raw HTTP and replay
  • Provider detection (Stripe, GitHub, Shopify, Slack, Twilio, PayPal, GitLab, Bitbucket…) with event type and signature header
  • Important-field and timestamp extraction, copy payload/headers/cURL, JSON export of all captures
  • Send-test-request button, open-in-new-tab, clear captures, delete endpoint with expiry countdown

Webhook Tester example

Capture a Stripe event

Input:

Stripe → POST https://www.mutqansoft.sa/hooks/3f9c…
Stripe-Signature: t=1725184801,v1=…
{"id":"evt_1PZx…","type":"payment_intent.succeeded",…}

Output:

POST /  12:00:01.120  1.4 KB
Provider: Stripe (high confidence) · Event: payment_intent.succeeded · Signature header: Stripe-Signature
Important fields: $.data.object.amount 19900 (199.00 if minor units) · $.data.object.created 1725184790 → 2024-09-01T10:39:50Z

Frequently asked questions about Webhook Tester

How long does my URL live?

Capture endpoints expire automatically after 24 hours. The URL is remembered in your browser session so a refresh keeps it; use "Delete endpoint" to remove it earlier.

How fast do requests appear?

The page polls every 3 seconds while the tab is visible and pauses when it is hidden, so deliveries show up almost immediately without wasting requests.

What is captured?

Method, path, query string, headers, the raw body (JSON and form bodies are also shown decoded), size, client IP and the exact time received. Cookie and cf-* headers are not recorded, and credential headers such as Authorization are stored as [redacted]. Bodies above 256 KB are truncated and marked; bodies over 4 MB are refused with 413.

Can I replay a delivery to my own server?

Yes — the Replay tab builds a cURL command against the URL you enter, keeping the provider headers and signature so your verification code can be tested; you run the command yourself. Credential headers were stored as [redacted], so put the real value back if your handler checks one, and timestamped signatures (Stripe, Slack) fail the usual 5-minute tolerance check when replayed later.

Does the endpoint respond to the provider?

It answers 200 OK with a small JSON body, which satisfies most providers' delivery checks.

Technical notes

The browser creates the endpoint with POST /api/v1/webhooks, keeps the id/token in sessionStorage and polls GET /api/v1/webhooks/:id/requests?after=<last timestamp> with the X-Webhook-Token header. Polling backs off on errors and stops when the tab is hidden.

References