Webhook Tester

A webhook URL is a unique address you can give to Stripe, PayPal, GitHub or your own code, and see every request that arrives at that URL: the method, the headers, the body. No sign-up, nothing to install. It's free.

Your webhook URLs

None yet — create one now.

How it works

  1. Create a webhook URL
  2. Send any request to it
  3. Read every request that arrives
  4. Open a caught request in the ReqBin API tester and send it to your own server

With the Business plan

  1. Answer senders with your own status code, content type and body
  2. Download everything an inbox has received
  3. Name your URL: hooks.reqbin.com/stripe-prod
  4. Keep your URL forever

See the Business plan

Webhook Examples

What is a webhook?

A webhook is an HTTP request a service sends to a URL you register with it, to notify you that an event has occurred on its side. Stripe sends a webhook when a payment succeeds, GitHub when a branch is pushed, Shopify when an order is placed. They are also called reverse APIs, web callbacks or HTTP push APIs.

Unlike the ReqBin API tester, which sends requests out to other services, a webhook goes the other way: the service sends it to your URL. Its body carries the details of the event — which payment succeeded, or which refund was issued.

What a webhook tester is for

The main problem when debugging webhooks is that your endpoint runs on localhost, and Stripe and GitHub cannot reach localhost. Receiving a real request there requires setting up a tunnel from a public address into your machine, which is not a trivial task.

A webhook tester is a URL that is already on the internet and open to the sender, accepts any request sent to it, and shows you the details as they arrive: the method, the full path, every header and the body.

That is also the only way to see what a sender really transmits, since requests from sandbox and production may differ, and the payload and headers it actually sends may not match what its documentation describes.

Security concerns when using webhooks

Anonymous webhook URLs are readable by anyone who knows the address, and a webhook payload usually carries private data — customer names, email addresses, amounts, access tokens. Point a sandbox at one rather than a live integration, and delete the anonymous webhook URL when you finish debugging.

Remove the URL from Stripe, GitHub or wherever you registered it as well, or the service keeps delivering to an address that no longer exists.

On your own endpoint, every request arrives unauthenticated. Verify the sender's signature — Stripe-Signature, X-Hub-Signature-256 — against the signing secret before trusting the body.

Webhook FAQ

How long does my URL live?

Anonymous URLs expire after three days. URLs in a free account expire in 30 days; URLs on the Business plan never expire.

How many URLs can I have?

Anonymous users may have one active URL, free accounts three at a time, and accounts on the Business plan twenty-five.

Can I share my inbox with someone else?

Anonymous inboxes are open to everyone: send the URL to whoever you want to show it to. An inbox bound to an account is closed; its owner can open it to anyone with the URL for a limited time.

Can I reply to the sender with my own status and body?

On the Business plan you may return your own status code and body to the sender.

Can I download everything an inbox received?

On the Business plan you may download everything an inbox holds as a file.

Can I choose my own URL name?

On the Business plan you may name a URL yourself, like hooks.reqbin.com/stripe-prod.