# Webhook sender > Send a mock Stripe, GitHub, Shopify, Slack or Twilio event to your endpoint. The webhook sender fires a realistic Stripe, GitHub, Shopify, Slack, Twilio or custom webhook event at an endpoint you own, signs it with your own secret so it passes real signature verification, and shows you the response your handler returned. Also: webhook sender, send test webhook, mock webhook, simulate webhook, test webhook endpoint, trigger a webhook manually, stripe webhook test, github webhook test, webhook signature test. ## What it does Testing a webhook handler normally means waiting for a real event to fire, or hand-writing a payload and hoping its shape is right. This sends a realistic one on demand: pick a provider, pick an event, point it at your endpoint, and read the status, headers, body and timing that came back. Paste your signing secret and the signature is computed in your browser, so the request passes the same verification your production code does — which is the difference between testing your handler and testing only the part of it that runs after the signature check. ## When to use it - You are writing a webhook handler and want to exercise it before a real event exists. - You need to check that your signature verification accepts a correctly signed request. - You want to see how your endpoint responds to a specific event type without triggering it upstream. - You are debugging a handler that works locally and want to replay the same event at a deployed URL. - You need to test a retry path by sending the same event twice. ## What you give it | Input | Meaning | | --- | --- | | Endpoint URL | The URL your handler listens on. It must be reachable from the public internet — use a tunnel URL such as ngrok or cloudflared for a local server. | | Provider and event | Stripe, GitHub, Shopify, Slack, Twilio or a custom event. Each one loads a realistic body and the header set that provider actually sends. | | Signing secret (optional) | Your own webhook secret or auth token. Used in your browser to compute the signature header and never sent anywhere else. Without it the event is sent unsigned rather than with a placeholder that could not verify. | | Body and headers | Both are editable before you send, so you can change a field, drop a header, or add one of your own. | ## What you get back | Output | Meaning | | --- | --- | | Response | The status code, response headers, body and round-trip time your endpoint returned, plus the raw response. | | A signed request | The signature header for the provider you picked, computed over exactly the bytes that were sent, in the format that provider's SDK expects. | | Session history | The last ten events you sent, with their status, so you can compare runs or reload one and send it again. | ## Key terms - **Webhook** — an HTTP request a service sends you when something happens, rather than one you send asking. Your handler is a normal endpoint that receives a POST. - **Signature verification** — a header carrying an HMAC of the request body, computed with a secret only you and the provider know. It is what proves the request really came from that provider, and it is why an unsigned mock will be rejected by production code. - **Signing secret** — the shared key the HMAC is computed with. Stripe calls it a signing secret, GitHub a webhook secret, Shopify an API secret key, Twilio an auth token — same idea in each case. - **Replay window** — the age at which a provider stops accepting a signed request even if the signature is valid. Stripe rejects anything with a timestamp older than five minutes, which is why the signed timestamp travels in the header. ## Questions ### Are these real events from Stripe or GitHub? No. They are mock events with the correct payload shape and header names for that provider, sent by this tool. Nothing is created or changed in your Stripe, GitHub, Shopify, Slack or Twilio account. ### Will Stripe's or GitHub's SDK accept the signature? Yes, once you paste your signing secret. The signature is computed in your browser over exactly the bytes that get sent, using each provider's own scheme — so Stripe's constructEvent, GitHub's HMAC check and Shopify's HMAC header all verify it. Without a secret the event is sent unsigned, and a handler that verifies signatures will correctly reject it. ### Where does my signing secret go? Nowhere. It is used by your browser to compute the signature and is never sent to Postman, never saved, and never included if you sign up and carry the request into the app. Only the resulting signature travels with the request. ### Can I send to localhost? Not directly. The request is sent from Postman’s Cloud Agent rather than from your browser, so it cannot reach an address that only exists on your machine, and private and loopback addresses are rejected. Expose your local server with a tunnel such as ngrok or cloudflared and send to that URL instead. ### Why not send it straight from my browser? Because a browser could not show you the response. A cross-origin POST carrying JSON triggers a CORS preflight that a webhook endpoint has no reason to answer, and the fallback makes the response opaque — no status, no headers, no body. Sending server-side is what makes the response panel possible. ### How do I test a retry or an expired timestamp? Send the same event twice to check that your handler is idempotent. To test the replay window, edit the timestamp in the signature header to be older than the provider tolerates — Stripe rejects anything more than five minutes old. ### Can I mock a provider that is not in the list? Yes. Pick Custom to send any JSON body, with any headers, to any endpoint. It signs with a generic sha256 HMAC header, and both the body and the headers are editable. ## Privacy The endpoint URL, the payload and your signing secret stay in your browser tab. The secret is used only to compute the signature and is never transmitted. The request itself is sent by Postman’s Cloud Agent so that a response can be read back; neither the request nor the response is stored, and the session history clears when you close the tab. ## Links - [Use the tool](https://www.postman.com/tools/webhook-sender) — the interactive version of this page. - [Postman Tools](https://www.postman.com/tools) — every free tool in this set. - [Webhook docs](https://learning.postman.com/docs/use/send-requests/protocols/webhooks/) — Postman documentation.