Webhook Inspector

How Webhook Inspector works

Webhooks are HTTP POST requests sent by external services (GitHub, Stripe, Shopify, Svix, etc.) to notify your application of events. Debugging them — especially verifying signatures and extracting nested fields — is tedious without the right tooling. This inspector lets you paste a raw payload and dissect it immediately.

1. 1

   Paste your headers and body

   Copy the raw headers and JSON body from your webhook log, server log, or proxy (like ngrok). Click "Load sample" to see a realistic GitHub push webhook. The body auto-formats as you paste, and any JSON errors are flagged immediately.

2. 2

   Verify the HMAC-SHA256 signature

   Most webhook providers sign their payloads using a secret you set in the provider's dashboard. Paste your webhook secret and the signature from the incoming header (e.g. X-Hub-Signature-256). The tool computes the expected HMAC-SHA256 and tells you whether the signature matches — catching replay attacks or misconfigured secrets.

3. 3

   Extract fields and generate cURL

   Use the Field Explorer to pull out deeply nested values by dot-path (e.g. commits[0].author.email). Click "Copy cURL" to get a ready-to-run curl command that reproduces the exact request against your endpoint — useful for replay testing.