Practical, copy-pasteable walkthroughs for common webhook debugging jobs.
Paste secret + raw body + signature header, see match/mismatch and exactly what was signed — GitHub, Stripe, Shopify, Slack, Zoom, Svix/Clerk, Twitch, Square, HubSpot, Mailgun, SendGrid (ECDSA), Intercom, Twilio. Runs 100% in your browser; the secret is never sent anywhere.
Realistic sample payloads — body and headers — for GitHub, Stripe, Shopify, Slack, Twilio, SendGrid, GitLab and Mailgun webhooks. One click opens any of them in a live capture bin.
Get a free URL that captures any webhook or HTTP request so you can inspect headers and body live — no signup, no install.
Deliver GitHub, Stripe or any webhooks to a server on your laptop with one shell script — no tunnel daemon, no ngrok account, no firewall changes.
Capture GitHub webhook deliveries, inspect the payload, and verify the X-Hub-Signature-256 HMAC signature — free.
GitHub webhook not working or not delivering? Isolate the failure with the Recent Deliveries log, a capture URL, and the documented causes: wrong events, timeouts, SSL, payload caps.
Capture Stripe webhook events at a free URL, inspect the exact payload and Stripe-Signature header, and verify the signature.
Why stripe.webhooks.constructEvent throws "No signatures found matching the expected signature": raw body parsing, wrong whsec_ secret, clock skew, proxy mutation — with the fix for each.
Slack's Events API requires your endpoint to echo a challenge. Do it with zero code using response templates — and capture every event.
Capture Shopify webhook deliveries at a free URL, inspect the exact payload, and verify the base64 X-Shopify-Hmac-Sha256 HMAC signature.
Capture Twilio SMS/voice webhooks at a free URL, see the form-encoded parameters decoded, and test your TwiML responses.
See the exact Update JSON Telegram sends your bot, diagnose last_error_message, fix 409 Conflict and port errors, and develop bots on localhost without a tunnel.
Why Discord rejects your interactions endpoint: the Ed25519 signature check, the deliberate invalid-signature probes, the PING ACK, raw-body gotchas, and how to develop locally.
Why WooCommerce webhooks arrive late or stop entirely: Action Scheduler / WP-Cron delays, the 5-failure auto-disable, the strict HTTP-200 activation ping, and how to verify X-WC-Webhook-Signature.
Honest comparison of free ways to get webhooks to localhost — cloudflared, localtunnel, SSH tunnels, and a no-tunnel relay approach — with the trade-offs of each.
How many times each provider retries a failed webhook, at what intervals, what counts as failure, and when it gives up or disables your endpoint — GitHub, Stripe, Shopify, Slack, Square, Svix and more, with sources.
Force any webhook sender to retry: return 500s, add response delays to trip timeouts, and observe the real retry schedule — without deploying anything.
requestbin.com shut down years ago. Here are the working free alternatives for inspecting HTTP requests and webhooks — and what each one paywalls.
webhook.site is fine for a two-minute look, but the free tier caps requests and paywalls replay, custom URLs, and the CLI. Honest rundown of the alternatives.
Beeceptor’s free tier caps you at ~50 requests per endpoint per day with short history. If you’re inspecting webhooks rather than mocking APIs, here are better free options.
mockbin.org no longer resolves; Kong folded Mockbin into Insomnia. Free working alternatives for inspecting HTTP requests and mocking webhook responses.
hookbin.com now redirects to Pipedream’s RequestBin; the standalone request-capture tool is gone. Free working alternatives for inspecting HTTP requests and webhooks.
smee.io forwards webhooks to localhost but drops every delivery that arrives while your client is disconnected. Alternatives that persist payloads, verify signatures, and need no Node client.
localtunnel is free but unreliable: interstitial password pages that block webhook senders, rotating URLs, npm client, frequent downtime. Free alternatives that actually deliver webhooks.
What ERR_NGROK_108, ERR_NGROK_3200, ERR_NGROK_121 and ERR_NGROK_6024 actually mean, the quick fix for each, and how to take webhooks out of the tunnel entirely.
Every free way to make a local server reachable from the internet — ngrok, cloudflared, SSH tunnels, Tailscale Funnel, VS Code port forwarding — plus the case where you don’t need to expose anything at all.
Why PayPal webhooks never arrive or fail verification: the HTTPS-443-only delivery rule, 25 retries over 3 days, simulator mock-event gotchas (WEBHOOK_ID), and the transmissionId|timeStamp|webhookId|crc32 signature string.
Fix "Url is blocked: Requests to the local network are not allowed", understand GitLab's 4-failure temporary disable and 40-failure permanent disable, read Recent events, and verify X-Gitlab-Token or the new webhook-signature header.
Bitbucket Cloud records no webhook history until you enable it. Where the request log hides, the 10-second timeout and -1 status, the 256 KB silent payload limit, 5xx auto-retries with X-Attempt-Number, URL-encoding traps, and verifying the WebSub-style X-Hub-Signature (sha256).
Fix a GitHub webhook that never triggers Jenkins: the /github-webhook/ trailing-slash 302, the "GitHub hook trigger for GITScm polling" checkbox, branch specifier mismatches, 403 crumb errors, multibranch differences, and reaching a Jenkins behind a firewall.
Why Zoom's endpoint.url_validation fails, how the plainToken/encryptedToken HMAC works, and how to pass it with zero code — including the 72-hour revalidation.
Why Meta's dashboard says the callback URL or verify token couldn't be validated (WhatsApp Cloud API, Messenger, Instagram), how the GET hub.challenge handshake works, and how to pass it with zero code — plus X-Hub-Signature-256 verification and the 7-day retry window.
Why your Twitch EventSub subscription is stuck in webhook_callback_verification_pending, how the challenge and the HMAC signature (message-id + timestamp + body) actually work, and how to pass the check with zero code.
Why verifyWebhook() throws, how the Svix signature (svix-id.svix-timestamp.body HMAC) actually works, and how to see exactly what Clerk sends — plus Resend, Railway, and every Standard-Webhooks sender.
Square's HMAC covers the notification URL plus the body — so a trailing slash, http vs https, or a changed tunnel URL breaks verification even when your code is right. Every cause, in order, plus the retry schedule.
HubSpot's X-HubSpot-Signature-v3 is an HMAC over method + URI + body + timestamp — so a proxy-rewritten URL, a re-serialized JSON batch, or 5 minutes of clock skew breaks it even when your code is right. Every cause, plus the v1/v2/v3 differences and the retry schedule.
Why an SNS HTTP/S subscription stays PendingConfirmation: the text/plain Content-Type trap, the SubscribeURL you never saw, the 3 fast retries, and how to confirm with zero code.
Mailgun's HMAC covers timestamp + token, not the payload — and the signature lives inside the body, not a header. Why your GitHub-style verifier never matches, which key to use, the 406 permanent-reject rule, and the 8-hour retry schedule.
SendGrid's Signed Event Webhook uses public-key ECDSA (P-256), so every HMAC verifier fails by construction. Where the Verification Key lives, what exactly is signed, the DER-vs-raw signature trap, and how to check a real delivery in one minute.
Notion sends your webhook's verification_token exactly once, in a POST you have to be ready to catch. How the verify step works, what X-Notion-Signature actually signs, why events arrive late or out of order, and the at-most-once retry policy nobody expects.
Paddle Billing signs webhooks with Paddle-Signature: ts=…;h1=…, an HMAC-SHA256 over ts:rawBody keyed with your destination's pdl_ntfset_ secret. Why verification fails — wrong destination key, re-serialized body, the 5-second timestamp tolerance — and how to check a real delivery in one minute.
Fix a Zapier Catch Hook that never fires: the paid-plan requirement, the stale 200 after a Zap turns off, unsupported payload formats, Catch Hook vs Catch Raw Hook, throttling delays — and how to see exactly what your app is sending.
Fix a Make (Integromat) custom webhook that never runs its scenario: the 200-Accepted-but-queued trap, scheduling vs Immediately, the webhook's own ON/OFF switch, data-structure 400s, missing headers, and the 5 MB limit — plus how to see what your app actually sends.
Fix an n8n Webhook node that returns 404 "webhook is not registered" or silently never runs: the webhook-test vs webhook URL split, the 120-second test window, publish-to-register, method mismatch, the Only-Run-If silent 200, reverse-proxy localhost URLs, and the Cloud 100-second deadline.
Add one JSON line and your AI agent (Claude Code, Cursor, any MCP client) can create webhook capture URLs, read what arrived, and block until the next webhook lands — no auth, no SDK.
Zendesk signs webhooks with base64 HMAC-SHA256 over an ISO-8601 timestamp + raw body — and test deliveries sign with a documented static secret while production uses a per-webhook one. The 5 verification failures in order, plus Zendesk's unusually narrow 409-only retry policy.
Asana won't create your webhook until your endpoint echoes the X-Hook-Secret request header back as a response header — while your own create call is still pending. How the handshake works, why single-threaded dev servers deadlock on it, the zero-code way to pass it, and the 24-hour delete-on-failure rule.
Adyen signs extracted fields, not the raw body — base64 HMAC-SHA256 over 8 colon-joined values, keyed with a HEX-DECODED key. The verification failures in order (hex-chars-as-key is #1), the escaping myth, the Banking-webhook header variant, and Adyen's 30-day sequential retry queue.
Patreon signs webhooks with hex HMAC-MD5 over the raw body (X-Patreon-Signature) — the only major provider still on MD5, and WebCrypto runtimes can't compute it at all. The verification failures in order, the X-Patreon-Event discriminator trap, and the queue-and-replay + paused:true retry model.
Trello webhooks die silently when the token that created them is revoked — the #1 cause of “worked for months, then stopped”. Plus the HEAD-must-200 creation trap behind “400: URL not reachable”, the 410-deletes-your-webhook rule, the 3-retry schedule, and the body+callbackURL HMAC-SHA1 signature.
Webflow webhooks created in the site dashboard send no signature headers at all — the #1 reason x-webflow-signature is missing. Plus the milliseconds timestamp trap, the two different signing keys (OAuth client secret vs per-webhook secret), the docs' own JSON.stringify re-serialization bug, and the 3×-10-minute retry schedule.
Why POST /push_subscriptions returns 400 “callback url: not verifiable”, how Strava’s GET hub.challenge validation actually works (JSON echo, not Meta’s plain-text echo), the 2-second deadline, the one-subscription-per-app rule, and what to do about Strava’s unsigned event deliveries.