Webhook Payload Tester

About This Tool

Test webhook payloads and generate HMAC signatures for verification. This tool runs entirely in your browser — no data is ever sent to a server. Free to use, no account required.

What a Webhook Tester Does

The webhook tester gives you a public URL to receive and inspect HTTP webhook payloads without setting up a server.

Receiving Webhook Payloads

Copy the unique test URL and configure it as the webhook endpoint in any third-party service. When that service fires a webhook, the tester captures the full HTTP request — headers, body, method, and timestamp — and displays it immediately.

Inspecting Webhook Structure

The captured JSON body is formatted and syntax-highlighted for easy reading. This lets you understand the exact payload structure before you write the handler code, so you know which fields are available and their types.

When to Use a Webhook Tester

A webhook tester is most valuable during the initial integration setup phase and when debugging unexpected webhook behavior.

Testing Third-Party Integrations

When setting up webhooks from Stripe, GitHub, Shopify, Twilio, or Slack, use a test URL to see the payload before building your handler. This prevents writing code against assumed payload structures.

Debugging Failed Webhooks

When a webhook integration is not working as expected, capture the actual payload to compare with what your handler expects. Differences in field names, types, or structure are a common source of webhook bugs.

JSON Webhook Payload Reference

Webhooks deliver JSON POST requests to your endpoint when events occur in external services. Understanding webhook payloads is essential for building integrations with payment processors, CI/CD systems, and SaaS platforms.

Common Webhook Payload Examples

// GitHub Push Event (simplified)
{
  "ref": "refs/heads/main",
  "commits": [
    {
      "id": "abc123",
      "message": "Fix login bug",
      "author": {"name": "Alice", "email": "alice@example.com"}
    }
  ],
  "repository": {"name": "my-app", "full_name": "alice/my-app"}
}

// Stripe Payment Intent Event
{
  "type": "payment_intent.succeeded",
  "data": {
    "object": {
      "id": "pi_abc123",
      "amount": 2000,
      "currency": "usd",
      "status": "succeeded"
    }
  }
}

Webhook Security Best Practices

Verify Webhook Signature (Node.js)

const crypto = require("crypto");

function verifyWebhook(payload, signature, secret) {
  const hmac = crypto.createHmac("sha256", secret);
  hmac.update(payload, "utf8");
  const digest = "sha256=" + hmac.digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(digest),
    Buffer.from(signature)
  );
}

// Express middleware
app.post("/webhook", (req, res) => {
  const sig = req.headers["x-hub-signature-256"];
  if (!verifyWebhook(req.rawBody, sig, process.env.WEBHOOK_SECRET)) {
    return res.status(401).send("Invalid signature");
  }
  res.status(200).send("OK");
  processEvent(req.body); // async processing
});

How to Test Webhooks with JSON

Follow these steps to send a test webhook payload and inspect the response from your endpoint.

1. Get your webhook endpoint URL from your application or service
2. Determine the expected JSON payload structure your webhook accepts
3. Enter the URL in the Endpoint field
4. Select the HTTP method (usually POST for webhooks)
5. Paste your JSON payload in the body field
6. Add required headers (e.g., Content-Type: application/json, X-Webhook-Secret)
7. Click Send and inspect the response status code and body

Example Webhook Payload Structures

// GitHub webhook payload (push event)
{
  "ref": "refs/heads/main",
  "repository": {"name": "my-repo"},
  "commits": [{"id": "abc123", "message": "Fix bug"}],
  "pusher": {"name": "alice"}
}

// Stripe webhook payload (payment_intent.succeeded)
{
  "type": "payment_intent.succeeded",
  "data": {
    "object": {
      "id": "pi_abc123",
      "amount": 2000,
      "currency": "usd",
      "status": "succeeded"
    }
  }
}

Common Webhook HTTP Headers

Most webhook services require specific headers for authentication and content negotiation. Include these when testing to replicate what a real caller would send.