b2KIT

Webhook Tester

Create temporary webhook endpoints to inspect incoming HTTP requests with full header and body logging.

Tested tool guide Tested browser tools Checked August 16, 2026

What Webhook Tester does, with a checked example

This tool issues a unique, disposable URL that you paste into a third-party service's webhook or callback field instead of your real backend. Any request that arrives at that URL, whatever the method, is captured and listed with its headers, query string, and raw body, usually within moments of being sent. The most common surprise is that the tool's own reply to the sender is generic, not the acknowledgment your real handler would return, so senders that inspect the response body or retry on an unexpected one may behave differently than once you're actually receiving requests.

Worked example

A concrete input and expected output from the current implementation.

Input

curl -X POST https://<generated-endpoint> -H 'Content-Type: application/json' -H 'X-Event-Type: payment.success' -d '{"amount":42,"currency":"usd"}'

Expected output

A new entry appears in the request log: method POST, Content-Type: application/json, X-Event-Type: payment.success, and body {"amount":42,"currency":"usd"} shown pretty-printed as JSON, alongside the arrival timestamp and source IP.

The tool does not transform the request; it stores and displays it as sent, so every header and the body appear verbatim.

How the result is produced

1

Endpoint generation and capture

You get a unique endpoint URL from the tool and paste it into the sending service's webhook or callback settings in place of your real server. Any request that lands on that URL, POST, GET, PUT, or whatever the sender uses, is stored server-side and appears in the tool's request list without you needing to write a receiving server of your own.

2

Per-request inspection view

Selecting a captured request expands the full request line, every header exactly as received, including casing and signature headers such as Stripe-Signature, and the body, pretty-printed when it's JSON. This lets you confirm the exact content type, payload shape, and auth headers your integration code needs to parse, instead of relying only on a provider's documentation.

Good uses

  • confirming what headers and payload a service like Stripe, GitHub, or Twilio actually sends before writing the handler that will process it
  • debugging a failing webhook integration by comparing the raw captured request against what the server-side code expects
  • standing in for a not-yet-built receiving endpoint while configuring a service's webhook settings during initial setup

Limits and checks

  • The endpoint is temporary; treat it as disposable rather than a long-term integration target, since it is not meant to back a production receiver.
  • It's a shared, publicly reachable URL backed by a server-side listener, not a browser-only tool, since a browser has no way to accept an inbound connection initiated by a third-party service; anyone who has the URL can post to it or potentially view captured requests, so never send real credentials, tokens, or personal data through it.
  • The tool's response to each incoming request is generic, not your application's real reply, so any sender logic that checks the response body, or retries on an unexpected response, won't behave the way it will against your actual server.

Common questions

Can I point my production integration at this endpoint permanently?

No. It's built for inspecting and debugging requests during setup or troubleshooting, not for receiving live traffic. The URL is temporary and the tool sends back a generic response rather than the reply your application logic would give, so downstream retry and verification behavior will differ from production.

Does it show the raw body, or does it alter JSON payloads when displaying them?

The captured-request view pretty-prints the body when the content type is JSON, purely for readability; the underlying stored body is the raw bytes as sent, so nothing in the payload itself is altered, only how it's formatted on screen.

References and verification

The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.

Related Tools