How we built a disposable Webhook Tester into BracketView — live capture, mocks, replay, and browser-side HMAC verification
If you’ve ever connected Stripe, GitHub, Shopify, or any “we’ll POST to your URL” product, you know the drill:
- Spin up a random request bin
- Trigger an event and hope the payload still looks like the docs
- Copy/paste JSON into Postman or Slack
- Fight signature verification on localhost
- Discover the bin expired and start over
That loop burns more time than the actual handler.
Webhook Tester is our answer — a disposable public endpoint + live inspect loop, built into BracketView (the same place people already go for JSON tools).
→ Try it free: https://app.bracketview.in/webhooks
What you get
| Capability | Why it matters |
|---|---|
| Public URL in seconds | Paste into any provider dashboard (hooks.bracketview.in/e/… style) |
| Live request feed | See POSTs/GETs land as they happen |
| Headers / query / body / raw | JSON tree when the body is JSON |
| Mock responses | Status, headers, body, optional delay — so setup isn’t blocked on a real server |
| Replay & edit-and-resend | Hit your tunnel or staging once you have code |
| Stripe / GitHub / Shopify signatures | HMAC verify in the browser — signing secrets stay local |
| Share one capture (Pro) | Encrypted snapshot link for that one cursed payload |
No account required to try. Guests own endpoints via a cookie; signed-in users get a more permanent attachment to their endpoints and Pro limits when needed.
The workflow we optimized for
1. Create → paste → watch
On the dashboard, create an endpoint (e.g. “Stripe test”), pick retention, copy the public URL into the provider.
Open the endpoint page for a live feed. Pause when you’re mid-inspect so new arrivals don’t jump the list out from under you.
Click a request → tabs for headers, query, body (JSON tree), raw, mock response, and signatures.
2. Mock before you implement
Many providers won’t finish webhook registration until they get a 2xx (or a specific body).
Configure:
- Status code
- Response headers
- Body
- Optional delay
Changes apply to future requests — so you can unblock product setup before your real handler exists.
3. Replay when the code is ready
When your app is up (local via tunnel or staging), replay a capture — or edit and resend after small tweaks.
Replay is intentionally constrained (SSRF-minded): private/metadata ranges, credentialed URLs, and similar foot-guns are blocked. Goal: “send this to my URL,” not “open proxy.”
4. Verify signatures locally
The Signature tab walks the common schemes:
- Stripe
- GitHub
- Shopify
Verification runs client-side. Your signing secret never needs to leave the browser for that check. Treat the public URL like a temporary secret; treat signing secrets like… actual secrets.
5. Share one capture (Pro)
Sometimes you don’t need a full log export — you need a second pair of eyes on one payload. Pro can share a single capture via an encrypted snapshot link (same pattern as BracketView’s JSON snapshots), instead of dumping PII into chat.
Free vs Pro
Free
- Active endpoints: 3
- Captures per endpoint: 25
- Max retention: 2 days (default 2)
- Body size: 256 KB
- Share a capture: No
Pro
- Active endpoints: 25
- Captures per endpoint: 5,000
- Max retention: 30 days (default 7)
- Body size: 1 MB
- Share a capture: Yes (encrypted snapshot)
Enough free for side projects and demos. Enough Pro for multi-project integration work without treating us as free forever-storage for production traffic.
Pricing / plans: https://app.bracketview.in/pricing
Why this lives inside a JSON toolkit
A huge share of modern webhooks are JSON. If you’re already opening a tree viewer to understand payloads, compare fixtures, or share a snapshot, jumping to another random “requestbin clone” that only dumps raw body is friction you don’t need.
Webhook Tester sits next to that workflow:
Capture → understand shape → mock provider demands → implement → replay → (optionally) share one bad event.
Also: webhooks aren’t free infinite logs. TTL, per-endpoint caps, and rate limits keep free usable for builders while keeping ops sane.
Security notes (worth spelling out)
- Public URLs are temporary secrets. Anyone with the URL can POST. Prefer shorter retention when you’re done exploring.
- Replay is guarded against classic SSRF patterns (private IPs, metadata endpoints, etc.).
-
Mock/replay headers are sanitized (no nasty CRLF /
Set-Cookiegames). - Signature verification is client-side for provider secrets.
- This accelerates development — it doesn’t replace production hardening of your real endpoints.
Who it’s for
- Indie builders wiring payments, OAuth, or marketplace events
- Backend engineers comparing sandbox vs live payload shape
- Support/debug when someone says “the webhook fired” and you need the body without production log archaeology
- Anyone tired of half a request bin + half of Postman’s job spread across five tabs
Quick start
- Open app.bracketview.in/webhooks
- New endpoint → name it → set retention
- Copy the public URL into Stripe / GitHub / Shopify / etc.
- Trigger a test event → watch the live feed
- Mock a 200 if the provider needs it
- When your handler is ready → replay to your tunnel
- Open Signature if you’re debugging HMAC failures
Closing
Webhook debugging shouldn’t start with scaffold and end with expired bins.
If you try Webhook Tester this week, I’d love a comment:
What webhook would you aim a disposable URL at first — Stripe, GitHub, Shopify, or something we should add signature presets for next?
🔗 Webhook Tester: https://app.bracketview.in/webhooks
🔗 BracketView app: https://app.bracketview.in
Happy building.
Top comments (0)