Webhook payload tester
Format webhook JSON and create test signature/header notes.
Inputs stay in your browser. Uses Web Crypto for optional HMAC-SHA256 signatures; the displayed headers are a local test convention.
Signatures use a custom x-gogo-* local test convention, not a provider format.
How to use this tool
Format webhook JSON and create test signature/header notes.
Inspect, format, and validate incoming webhook JSON payloads from Stripe, GitHub, or Shopify. Simulate HMAC-SHA256 cryptographic signatures to verify tamper-proof integration payloads.
💡 3 Quick Steps to Get Started
Paste raw incoming JSON data into the payload inspection editor.
Instantly catch JSON syntax errors and view formatted indentation hierarchies.
Input your webhook secret to compute HMAC-SHA256 digests matching provider security headers.
When it helps
Useful for docs, test fixtures, and support diagnostics.
How it works
Uses Web Crypto for optional HMAC-SHA256 signatures; the displayed headers are a local test convention.
Worked example
Example: paste a payment-complete event and generate test headers.
Limits and data handling
The displayed headers are a local test convention, not an official verification format for any webhook provider.
No. The Webhook payload tester runs in the browser. Do not paste production secrets or unredacted personal data.
Webhook Architecture, HMAC Signatures & Idempotency Guide
1. Event-Driven Webhook Architecture vs. Polling
Webhooks replace wasteful client polling loops with real-time HTTP POST notifications triggered by upstream lifecycle events (payment completions, git merges, order fulfillment). Engineering resilient consumers requires handling network partitions, duplicate deliveries, and out-of-order execution.
2. HMAC-SHA256 Cryptographic Signature Verification
To prevent man-in-the-middle forging, providers append signed message authentication codes (e.g., `Stripe-Signature`). Consumers must compute `HMAC_SHA256(Secret, Timestamp + "." + RawPayload)` and compare signatures using constant-time string comparison while enforcing timestamp replay tolerances.
3. Consumer Idempotency and Exponential Backoff Retries
Production webhook handlers must enforce database deduplication keyed on unique `event_id` identifiers, ensuring identical deliveries return HTTP 200 without executing duplicated side effects.
Feedback
How can we improve this tool?
Send a suggestion or bug report for this tool.
FAQ
What input does the Webhook payload tester accept?
Enter a JSON payload and an optional test secret.
How does the Webhook payload tester produce its result?
It formats JSON and can create a local HMAC-SHA256 test signature with Web Crypto.
What are the Webhook payload tester limitations?
The displayed headers are a local test convention, not an official verification format for any webhook provider.
Does the Webhook payload tester upload data?
No. The Webhook payload tester runs in the browser. Do not paste production secrets or unredacted personal data.
