Simulate and Test Webhook Endpoints Locally
How It Works
The tool maintains a library of structural mock payloads matching the actual API shapes of each provider. When you select an event type (e.g. Stripe charge.succeeded, GitHub push, Shopify order.created), it assembles a complete JSON payload with realistic field values, headers (Content-Type, User-Agent), and webhook signature headers like Stripe-Signature or X-Shopify-Hmac-SHA256. The request is dispatched via the Fetch API directly from your browser to the target URL you specify, and the full HTTP response - status code, headers, and body - is captured and displayed in the history log.
Worked Example
Select: Stripe ? charge.succeeded
Target URL: http://localhost:3000/api/webhooks/stripe
Expected behavior: Your local server receives a POST request with a JSON body containing the charge object (id, amount, currency, status, customer email). The Stripe-Signature header is included so your signature verification middleware can parse it. A 200 response from your server indicates the webhook was handled successfully, while a 4xx or 5xx reveals a bug in your receiver logic.
Common Mistakes
- Not handling CORS on localhost. Browser fetch requests to localhost are subject to CORS unless your dev server includes
Access-Control-Allow-Origin: *. If the request fails silently, check your server's CORS configuration or use the generated cURL command instead. - Using production endpoints during development. Sending test payloads to live Stripe or Shopify webhook URLs can trigger real side effects - charges, emails, order fulfillment. Always use a local dev server or a dedicated staging endpoint with test mode enabled.
- Ignoring webhook signature validation. The tool generates placeholder signature headers, but your production receiver should verify real signatures. Test your signature verification middleware separately with actual provider secrets rather than relying solely on mock signatures from this tool.
Frequently Asked Questions
Q:What is Webhook Tester?
Webhook Tester is a client-side developer utility built to simulate, send, and troubleshoot API webhooks. You can generate real payloads from Stripe, Shopify, or GitHub, and deliver them directly to your local endpoints (like localhost:3000) right from your web browser.
Q:Why do I see a "CORS or Network Failure" error when calling localhost?
Since this utility executes entirely within your browser for privacy, outbound requests are subject to browser CORS (Cross-Origin Resource Sharing) constraints. If your local API server is not configured with CORS headers (specifically Access-Control-Allow-Origin: *), the browser will block the response. To bypass this, configure CORS on your server, use a CORS browser extension, or use the generated cURL command in your terminal.
Q:How do I test webhook signature verification?
The tester automatically calculates standard headers, such as Stripe-Signature or X-Shopify-Hmac-Sha256, and fills them with dummy values. This allows you to verify that your webhook controller is extracting and reading the proper header keys, even if cryptographically authentic validation requires the official provider signature.
Q:Is my webhook payload sent to KRUMB.DEV servers?
No. All requests are fired client-side directly from your browser to your local or remote webhook endpoint. Your payloads, target URLs, and response logs never touch KRUMB.DEV servers, guaranteeing total data security and privacy.
Q:Can I use Webhook Tester with production webhooks?
Yes - you can point the tester at any HTTPS endpoint, including production or staging servers. However, use caution when sending test payloads to production endpoints that may trigger real side effects like charges or emails. The tool is primarily designed for local development and sandbox testing where you control the receiving server.