Are these real events from Stripe or GitHub?
No. They are mock events with the correct payload shape and header names for that provider, sent by this tool. Nothing is created or changed in your Stripe, GitHub, Shopify, Slack or Twilio account.
Will Stripe's or GitHub's SDK accept the signature?
Yes, once you paste your signing secret. The signature is computed in your browser over exactly the bytes that get sent, using each provider's own scheme — so Stripe's constructEvent, GitHub's HMAC check and Shopify's HMAC header all verify it. Without a secret the event is sent unsigned, and a handler that verifies signatures will correctly reject it.
Where does my signing secret go?
Nowhere. It is used by your browser to compute the signature and is never sent to Postman, never saved, and never included if you sign up and carry the request into the app. Only the resulting signature travels with the request.
Can I send to localhost?
Not directly. The request is sent from Postman’s Cloud Agent rather than from your browser, so it cannot reach an address that only exists on your machine, and private and loopback addresses are rejected. Expose your local server with a tunnel such as ngrok or cloudflared and send to that URL instead.
Why not send it straight from my browser?
Because a browser could not show you the response. A cross-origin POST carrying JSON triggers a CORS preflight that a webhook endpoint has no reason to answer, and the fallback makes the response opaque — no status, no headers, no body. Sending server-side is what makes the response panel possible.
How do I test a retry or an expired timestamp?
Send the same event twice to check that your handler is idempotent. To test the replay window, edit the timestamp in the signature header to be older than the provider tolerates — Stripe rejects anything more than five minutes old.
Can I mock a provider that is not in the list?
Yes. Pick Custom to send any JSON body, with any headers, to any endpoint. It signs with a generic sha256 HMAC header, and both the body and the headers are editable.