How to Test Vercel Webhooks

Vercel Webhook Event Types

Vercel supports webhooks at both the team level and the project level. Team-level webhooks receive events from all projects in the team; project-level webhooks are scoped to a single project. Every delivery is a POST request with a JSON body and a type field that identifies the event.

Step 1: Generate a Requex Endpoint

Open requex.me. A unique webhook URL is generated automatically — no sign-up required. Copy the URL from the dashboard header. It looks like:

https://requex.me/hook/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

Keep this tab open. Every request Vercel sends will appear in real time without polling.

Step 2: Add the Webhook in Vercel

Vercel supports webhooks at both the team and project level. For team-wide events:

1. Go to Vercel Dashboard → Team Settings → Webhooks.
2. Click Add Webhook.
3. Paste your Requex URL into the Endpoint URL field.
4. Select the events you want to receive (e.g., deployment.created, deployment.ready).
5. Click Create Webhook.

For project-scoped webhooks, navigate to the specific project and go to Project Settings → Git → Deploy Hooks. Note that deploy hooks are one-directional triggers (they trigger a deployment when called), whereas outgoing webhooks in Team Settings are what notify your endpoint of events.

Step 3: Trigger a Test Deployment

The quickest way to trigger a webhook is to push to the git branch connected to the project:

# Push a change to trigger a deployment event
git commit --allow-empty -m "chore: trigger vercel webhook test"
git push origin main

Alternatively, use the Vercel CLI to deploy directly:

npx vercel deploy

Vercel fires deployment.created immediately when the build starts, then deployment.ready or deployment.error when it finishes. Both should appear in your Requex dashboard within seconds.

Step 4: Inspect the Payload

Click any captured request in Requex to expand the full JSON body, headers, and query parameters. A typical deployment.ready payload looks like:

{
  "type": "deployment.ready",
  "createdAt": 1712345678901,
  "payload": {
    "deploymentId": "dpl_xxx",
    "url": "myapp-git-main.vercel.app",
    "name": "my-app",
    "target": "production",
    "meta": {
      "githubCommitRef": "main",
      "githubCommitSha": "abc123"
    },
    "team": {
      "id": "team_xxx",
      "slug": "my-team"
    }
  }
}

The top-level type field is the event name. All deployment-specific data lives under payload. The target field distinguishes production deployments from preview deployments.

Vercel Webhook Security

Vercel signs each webhook delivery with an HMAC-SHA1 signature. The signature is sent in the x-vercel-signature header as a hex digest. To verify in production:

const crypto = require('crypto');

function verifyVercelSignature(rawBody, signature, secret) {
  const expected = crypto
    .createHmac('sha1', secret)
    .update(rawBody)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

// Express example
app.post('/webhooks/vercel', express.raw({ type: '*/*' }), (req, res) => {
  const sig = req.headers['x-vercel-signature'];
  if (!verifyVercelSignature(req.body, sig, process.env.VERCEL_WEBHOOK_SECRET)) {
    return res.status(401).send('Invalid signature');
  }

  const event = JSON.parse(req.body);
  console.log('Event type:', event.type);
  res.status(200).send('OK');
});

You set the webhook secret when creating the webhook in Vercel Team Settings. Requex lets you inspect the raw x-vercel-signature header value alongside the body so you can validate your HMAC logic before deploying your handler.

Common Vercel Webhook Issues