Do I need an account?
No. Press Create a webhook URL and it starts receiving immediately. Signing up is only needed to keep the URL and the requests it captured.
How long does my URL stay live?
As long as this tab's session lasts, which is a matter of minutes rather than days — it is a throwaway URL for looking at a payload, not a permanent endpoint. There is no way to extend it: the URL belongs to the anonymous session that created it, so when that session ends the tool tells you and offers a new URL. Sign up free to get one that is permanent and tied to your workspace.
Is my webhook URL private?
It is unique and unlisted, but it is not a secret in any strong sense — anyone who has the URL can send requests to it, and anything sent to it is visible in this tab. Treat it like a shared link: fine for test events, not somewhere to point production traffic carrying real customer data.
My provider's signature verification fails on these requests. What is wrong?
Almost always body-parsing middleware running before your verifier. The signature covers the exact bytes that arrived, so anything that parses and re-serialises the body first — express.json(), request.json, a framework default — changes those bytes and breaks a signature that was valid. Read the raw body, verify it, then parse; the handler code on this page does exactly that. The other usual causes are mixing test-mode and live-mode secrets, reading the wrong header (GitHub sends X-Hub-Signature-256, not X-Hub-Signature), and a server clock skewed further than the provider's timestamp tolerance.
Why are there headers I did not send?
Your request passes through a CDN and a service mesh on the way in, and both add their own headers. Those are listed separately from the caller's, so the Headers tab shows what the provider sent rather than two dozen routing and tracing headers. The curl command this page generates replays only the caller's headers, for the same reason.
Can I make it return a specific status code or body?
Not in this tool. Every request gets a 200 with a small JSON acknowledgement, which is what a provider needs to consider delivery successful and stop retrying. Custom and conditional responses are part of webhook listeners in the Postman app.
Can I replay a captured request to my own server?
Not from here. Sign in with a free Postman account to replay any captured request to any URL, including a local server over a tunnel such as ngrok or cloudflared.
How many requests does it keep?
The last 100 per URL, newest first. The list shows the most recent 20 at a time.