Free Webhook Inspector Inspect HTTP Headers & JSON Payload

Webhook Inspection vs Just Receiving

Receiving a webhook means your endpoint accepted the request and returned a 200. Inspecting means you know exactly what the provider sent: headers, content-type, raw body format, and signature values — before your handler made assumptions about any of it.

The difference matters most when debugging integration failures. If your handler is rejecting events, receiving tells you it happened — inspection tells you why. A missing header, an unexpected content-type, a payload structure that differs from the documentation: none of these are visible without looking at the raw request.

What to Look for When Inspecting a Webhook

• Content-Type header — Verify the provider sends application/json. Some providers send application/x-www-form-urlencoded or text/plain. Calling JSON.parse() on a URL-encoded body causes silent failures.
• Signature headers — Stripe uses Stripe-Signature, GitHub uses X-Hub-Signature-256, Shopify uses X-Shopify-Hmac-SHA256. One typo in the header name in your verification code fails every event.
• HTTP method — Most webhooks use POST, but some providers use GET for URL verification challenges or PUT for update events. Check the method matches your route handler.
• Event type field — Many providers include the event type in both a header (X-GitHub-Event) and the body. Confirming both match catches routing bugs before production.

Step-by-Step Inspection Walkthrough

Here's how to perform a complete webhook inspection with Requex.me:

Quick inspection with cURL: send a test webhook from your terminal:

curl -X POST https://requex.me/hook/YOUR-WEBHOOK-ID \
  -H "Content-Type: application/json" \
  -H "X-My-Signature: sha256=abc123..." \
  -H "X-Event-Type: order.created" \
  -d '{"id": 99, "event": "order.created", "amount": 149.00}'

Payload Debugging Checklist (8 Items)

• □Content-Type is application/json (not form-encoded or text/plain)
• □HTTP method matches your route handler (POST, not GET)
• □Signature header name is spelled correctly (exact case matters)
• □Event type field exists in the body (not just in headers)
• □Payload fields match your handler's deserialization struct/schema
• □No unexpected nesting — e.g., data.object.id vs data.id
• □Timestamp field is in the format your handler expects (Unix vs ISO8601)
• □No extra fields that could cause strict deserialization to fail

How to Inspect Webhook Signatures

Signature verification is the most common source of webhook integration bugs. Use Requex.me to capture the exact signature value your provider sends, then replay it to your local handler:

# Replay a captured Stripe webhook to your local handler
curl -X POST http://localhost:3000/api/webhooks/stripe \
  -H "Content-Type: application/json" \
  -H "Stripe-Signature: t=1234567890,v1=abc123..." \
  -d '{"id":"evt_xxx","type":"payment_intent.succeeded",...}'

See the full signature verification walkthrough in the webhook security best practices guide.

Frequently Asked Questions

Related Tools & Guides