Webhook Tester

A webhook is an HTTP POST request that one service sends to another when an event occurs (e.g., GitHub sends a push event, Stripe sends a payment event). To test a webhook handler, you need to send a realistic payload to your endpoint with the right headers. This tool generates accurate sample payloads for popular services and gives you a curl command to send them from your terminal.

Browsers enforce CORS (Cross-Origin Resource Sharing) policies, so a browser-based tool can't send POST requests to arbitrary endpoints on localhost or other domains. curl runs outside the browser and can send requests anywhere — making it the standard way to test webhook endpoints during local development.

Most services sign webhook payloads using HMAC-SHA256 with a secret key. GitHub uses X-Hub-Signature-256, Stripe uses Stripe-Signature (with timestamp + signature), and Slack uses X-Slack-Signature. Your handler should validate this signature against the raw request body before processing. The sample headers in this tool show placeholder signatures — replace them with real ones from your service dashboard.

Use a tunneling tool like ngrok (ngrok http 3000) or Cloudflare Tunnel to expose your local port to the internet. Copy the public URL, register it in your service's webhook settings, and trigger real events. For faster iteration without real events, use this tool to generate curl commands that replicate the exact payload format — no internet required.

GitHub webhooks include: Content-Type (application/json or application/x-www-form-urlencoded), X-GitHub-Event (the event name, e.g. push, pull_request), X-GitHub-Delivery (a UUID for the delivery), X-Hub-Signature (HMAC-SHA1 of the body, deprecated), and X-Hub-Signature-256 (HMAC-SHA256, preferred). Always validate X-Hub-Signature-256 against your webhook secret.

Stripe's Stripe-Signature header contains a timestamp (t=) and one or more signatures (v1=). To verify: 1) extract the timestamp, 2) construct the signed payload string as timestamp + '.' + raw body, 3) compute HMAC-SHA256 of that string using your endpoint's signing secret, 4) compare against the v1 signature. Never parse JSON before signature verification — you need the raw body bytes. Use Stripe's official SDK webhooks.constructEvent() method.