Webhook tester & request bin.
A throwaway URL that catches whatever is sent to it and shows each request the moment it arrives, headers and body included. Point a webhook at it, watch it land, copy it as curl.
About this tool
Creating a bin gives you two URLs: a short capture address of the form /b/<id> that you hand to whatever you are testing, and a viewer page that streams every request it receives over a server-sent events connection. Each request shows the method, path, query string, headers, body (pretty-printed when it is JSON) and the sender's address, with one-click copy of the body or of an equivalent curl command so you can replay it against your real endpoint.
Bins can be created and read from a script too; the API and curl reference shows how.
How to test a webhook
- Press Create a bin and copy the capture URL.
- Paste it into the webhook settings of the service you are integrating (payment provider, Git host, chat platform, form builder).
- Trigger the event. The request appears in the viewer the moment it arrives, with every header and the raw body.
- Copy it as curl and replay it against your development server as many times as you need while you write the handler.
What you can see
| Field | Why it is useful |
|---|---|
| Method and path | Anything appended to the capture URL is recorded, so /b/<id>/orders/123?dry=1 shows the sub-path and query the caller used. |
| Headers | Content-Type, User-Agent, and the signature header (Stripe-Signature, X-Hub-Signature-256, X-Slack-Signature) you need to verify. See how to verify webhook signatures. |
| Body | The raw payload, byte for byte. Valid JSON is pretty-printed for reading; the copy button gives you the original, which matters for signature checks. |
| Timing | When each request arrived, so you can measure a provider's retry schedule and backoff. |
| Sender address | The IP the request came from. Run it through the ASN lookup to confirm it belongs to the provider. |
Typical uses
- Seeing exactly what a payment provider, Git host or chat platform posts before writing the handler.
- Confirming a retry policy: how many attempts, how far apart, whether the payload changes.
- Capturing a mobile app's or IoT device's requests by pointing it at the bin, with no proxy setup.
- Checking that a cron job, CI pipeline or serverless function actually fires, and with which parameters.
- Getting a fast answer to "did the request even leave the building".
Limits and privacy
Bins are held in memory on a single server. They vanish after 15 minutes without traffic, or 90 minutes regardless, and if the process restarts. Bin pages are never indexed by search engines. Do not send anything here you would not be happy to have on a shared screen; the URL is unguessable but not a secret you should rely on.