Web Appv0.31.1
Style Experiment Reporting
- •The visual-style split now reports its arm under the variant keys PostHog expects, so the experiment results line up
Changelog
Web v0.31.1CLI v1.3.0SDK v1.10.0MCP v1.8.0
Web Appv0.31.0
A Clean Visual Style
- •A second visual style: switch between the bold classic look and a clean one with thin borders, rounded corners, soft shadows, and sentence-case labels
- •The style switch sits next to the light and dark mode switch in the header, works with both modes, and is remembered in your browser
Web Appv0.30.1
Dependency Security Updates
- •Nodemailer moved to 10.x, closing the address-parser denial of service, the recipient-domain validation bypasses, and the file-access bypass reported against earlier releases
- •Transitive dependency floors raised for hono (4.13.5), js-yaml (3.15.2 and 4.3.2), and @ai-sdk/provider-utils (4.0.33) to pick up their security fixes
- •Routine dependency bumps: Next, jose, Supabase SSR, zod, lucide-react, posthog-js, resend, simple-icons, vitest 5, swagger-parser 13, Playwright, tsx, postcss, plus tower-http, constant_time_eq, and open on the Rust side
Web Appv0.30.0
Search Finds Requests on Shared Endpoints
- •Searching and counting requests now covers endpoints shared with you through a subscribed team, in the dashboard and through the API, instead of only endpoints you own (migration 00039)
- •Requests on shared endpoints follow the endpoint owner's retention, not the searcher's plan, matching what the request list already shows team members
- •Endpoints shared with you now also carry `fromTeams`, every one of your subscribed teams the endpoint is shared with, alongside the existing `fromTeam` (the oldest share)
- •Teams docs gained a section on working with shared endpoints from the CLI, SDK, and MCP server; the OpenAPI description of endpoint listing no longer says shared endpoints need a Pro plan
CLIv1.3.0
Teams from the Terminal
- •New `whk teams` commands: `list` shows your teams with seats, pooled usage, and status; `members <team>` lists members and pending invites; `share <slug> --team <team>` and `unshare` manage sharing; `invite <team> <email>`, `invites`, `accept`, and `decline` handle invites. Teams are addressed by id or by name
- •`whk list --team <team>` keeps only the endpoints tied to one team, whether shared with you from it or yours shared with it; the team is resolved the same way as in `whk teams`, so an unknown or ambiguous name is an error
- •`whk teams invite` reports when the invite was created but its email could not be sent, instead of claiming the invitee was notified
- •`whk usage` prints the pooled quota of every subscribed team you belong to under your personal plan, and `--json` adds a `teams` array (plus `teamsError` if the pools could not be loaded)
- •`whk requests search` and `count` now find requests on endpoints shared with you (server-side change in web 0.30.0)
- •Fixed `whk requests search`, which failed to parse the search response since the API started returning a plain array; each hit now shows its endpoint slug
SDKv1.10.0
Teams Namespace
- •New `client.teams` namespace: `list()` returns your teams with seats and pooled `requestsUsed`/`requestLimit`; `members(teamId)`, `share(teamId, slug)`, `unshare(teamId, slug)`, `invite(teamId, email)`, and `invites.list/accept/decline` mirror the team routes. Share and unshare take a slug and resolve the endpoint id for you
- •`endpoints.list({ team })` keeps only endpoints tied to a team id or unique name (resolved through `teams.list()`, so an unknown or ambiguous name throws), matched against `fromTeams`, `fromTeam`, and `sharedWith`; `Endpoint.fromTeams` is new and lists every one of your teams a shared endpoint belongs to
- •New `Team`, `TeamMember`, `TeamInvite`, `TeamMembers`, and `ListEndpointsOptions` types; `TeamInvite.warning` is set when the invite was created but its email could not be sent; `describe()` documents the teams operations
- •`requests.search` and `requests.count` now return requests on endpoints shared with you (server-side change in web 0.30.0)
MCPv1.8.0
Team Tools
- •Four new tools: `list_teams` (seats, pooled usage, status), `list_team_members`, `share_endpoint`, and `unshare_endpoint`, bringing the tool count to 35. Invites stay out of MCP because accepting one claims a paid seat
- •`list_endpoints` accepts an optional `team` (id or name) to keep only that team's endpoints
- •`get_usage` adds a `teams` array with the pooled quota of every subscribed team you belong to; if the team list cannot be loaded the personal usage is still returned with a `teamsError`
- •`search_requests` and `count_requests` now find requests on endpoints shared with you (server-side change in web 0.30.0)
Web Appv0.29.2
Webhook Total No Longer Drops on Deletion
- •The webhooks-processed total on the landing page kept the counts of endpoints removed by the guest cleanup but lost them when you deleted an endpoint or your account; counts from every deleted endpoint are now preserved (migration 00038)
Web Appv0.29.1
Security and Reliability Fixes from the Architecture Review
- •Database privileges hardened: signed-in users can no longer update their own plan or limits through the database API, and every stored procedure is callable by the server only (migration 00037)
- •Team members now receive live dashboard updates for endpoints shared with their team instead of having to refresh
- •Guest endpoint reads no longer expose ephemeral endpoints that belong to a signed-in user
- •Deleting an account now cancels the Pro subscription and the subscriptions of teams you own first, and refuses to delete if that fails, instead of leaving them billing
- •Endpoint lookups by slug use a proper index again (the hottest query in the receiver)
- •Webhooks whose body, path or query contain a NUL byte are stored (raw bytes preserved) instead of being silently dropped with a 200
- •The receiver answers 503 with Retry-After on transient database failures so senders retry, and reports capture outcomes as metrics
- •Rate limits are keyed on the Cloudflare client IP, so a forged X-Forwarded-For no longer bypasses them
- •The landing page syncs guest endpoints by polling instead of holding a Realtime channel that could never deliver
CLIv1.2.0
Tunnels That Stay Up
- •`whk tunnel` and `whk listen` reconnect automatically: the server rotates stream connections every 30 minutes, and the CLI now resumes from the last request it saw instead of stopping silently
- •Network errors and stream drops retry with backoff and are reported; authentication and not-found errors exit non-zero with a message instead of exiting 0
- •A stream that goes quiet for 90 seconds (no keepalive) is treated as dead and reconnected
- •`whk tunnel` keeps the endpoint it created unless you pass `--ephemeral`, and prints how to reuse or delete it on exit
SDKv1.9.1
Streams Survive the 30-Minute Rotation
- •`requests.subscribe(slug, { reconnect: true })` now reconnects transparently when the server rotates the connection (every 30 minutes) and resumes from the last request it saw; previously the iterator ended silently
- •New `idleTimeout` option (default 90s): a stream with no keepalive for that long is reconnected (or ends with a TimeoutError when `reconnect` is off) instead of hanging forever
- •Reconnects no longer accumulate abort listeners on the outer signal
Web Appv0.29.0
Sign In with Email and Password
- •Create an account with an email address and password, alongside GitHub and Google: sign-up sends a confirmation link, and the account is usable once the email is verified
- •Forgot password? Request a reset link from the login page and choose a new password on the reset page; the link works in any browser
- •Team invitees without a GitHub or Google account can now sign up with the invited email address and the invite is waiting for them
- •OAuth errors and invalid email links now show a message on the login page instead of being dropped
Web Appv0.28.1
Fix: Team Checkout for Owners Who Already Have a Polar Customer
- •Team checkout no longer fails for owners who already have a personal Pro subscription (or own another team): the team's Polar customer is now created as a team customer with the owner as its owner member, instead of a second customer on the owner's email, which Polar rejects
- •Team billing errors now reach the browser with their detail instead of being swallowed by Cloudflare's 502 page
- •Polar errors are logged without the request's authorization header
Web Appv0.28.0
Invite Anyone to Your Team by Email
- •Team invites no longer require the invitee to have an account: invite any email address, they get an invite email, and signing up with that address links the invite to their new account automatically
- •Invite emails tell the invitee who invited them, to which team, and where to accept
- •Clicking Subscribe again within 30 minutes reuses the open checkout session for the same seat count instead of creating a second one, and the billing webhook ignores events from a subscription the team doesn't hold
- •Pro renewals now reset the monthly request counter the moment the renewal lands instead of relying on a background sweep
- •When a member leaves or is removed, the endpoints they shared with the team are unshared so their traffic stops drawing from the team pool
- •Checkout failures now surface Polar's validation detail (e.g. a rejected billing email) instead of a bare error
Web Appv0.27.0
Teams Is Now Its Own Seat-Based Plan
- •Teams no longer requires Pro — any account can create a team, and the team carries its own subscription at $12/seat/mo
- •Every seat adds 100,000 requests per 30 days to a pool shared by the whole team: requests on team-shared endpoints bill the team instead of the endpoint owner
- •Seats are the member cap — add a seat to add a member, and freed seats are reusable
- •Team-billed requests are kept for 31 days regardless of the endpoint owner's plan
- •Per-team billing through Polar: subscribe, adjust seats, cancel, and resubscribe from the team page
- •A team without an active subscription is suspended — its data is kept, but invites, sharing, and member access to shared endpoints pause until it subscribes
Web Appv0.26.3
Security: dependency updates across the stack
- •Next.js 16.2.11, patching several security advisories in the framework
- •All open Dependabot security alerts resolved: hardened transitive dependencies (sharp, tar, js-yaml, dompurify, hono, and friends) via lockfile overrides
- •Routine dependency refresh: React 19.2.8, Supabase SSR, Radix UI, Polar SDK, PostHog, and the Rust receiver/CLI dependency set (including a quinn-proto advisory fix)
Web Appv0.26.2
Fix: CLI login no longer locks out at the API key cap
- •CLI device logins at the 10-key limit now rotate the oldest CLI-issued key instead of failing with an opaque “Claim failed” — manually created keys are never touched
- •When a claim does hit the cap (all keys manually created), the CLI now shows an actionable message pointing to the account page instead of “Claim failed”
CLIv1.1.3
Self-Update Rescue for v0.x Installs
- •Releases again include the legacy `whk_<os>_<arch>` archives (with checksums), so `whk update` works from pre-1.0 installs — v0.6.0 users stuck on “no release asset for darwin/arm64” can now update straight to the current version
- •No binary changes — identical CLI code to 1.1.2
Web Appv0.26.1
Fix: stale delete button in endpoint settings
- •Fixed the endpoint settings dialog showing a disabled “Deleting...” button when opening another endpoint's settings right after deleting one — previously only a page reload cleared it
Web Appv0.26.0
The Landing Page Is Now the Dashboard
- •Visit webhooks.cc and you're in the inspector: a live guest webhook URL is created the moment you arrive — no signup — with the full request dashboard (live feed, body tree, headers, replay) filling the first screen
- •One-click test sends from the empty state: a custom payload or signed Stripe, GitHub, and Shopify templates, plus a copy-able curl command
- •One click with GitHub or Google keeps your guest endpoint and unlocks the free plan — messaging now spells this out at every step, including a guest-vs-free comparison
- •/go retired: it permanently redirects to the landing page, which now provides the same experience
- •Crawler protection: guest endpoints are no longer created for bots (server-side user-agent screen + creation waits for a human input signal)
- •SEO: HowTo structured data, new FAQ entries, and an instant-URL page title and description
Web Appv0.25.0
Landing Redesign + Per-Provider Webhook Pages
- •New provider pages at /webhooks — setup steps, signature details, and sample events for all 32 supported providers, plus a browsable hub grouped by category
- •Landing page redesigned around a sign-up-first hero: prominent GitHub/Google start-free buttons, with the no-signup guest endpoint as the secondary path
- •New provider strip and navbar links (Docs, Providers, Compare, Pricing, Blog) for easier discovery
- •SEO: provider pages added to the sitemap, /agent/claim marked noindex
Web Appv0.24.0
4 New Providers — DocuSign, Adyen, PayPal, Plaid
- •Provider catalog grows from 28 to 32: added DocuSign, Adyen, PayPal, and Plaid across templates and detection
- •Server-side signature verification now supports DocuSign HMAC, Adyen body-embedded HMAC, and PayPal RSA certificate verification; Plaid remains template-only until Plaid JWT/JWK credentials are supported
- •Endpoint settings and the Signature tab use provider-specific credential labels, including PayPal Webhook ID and Adyen HMAC Key
SDKv1.9.0
4 New Providers — DocuSign, Adyen, PayPal, Plaid
- •Added DocuSign, Adyen, PayPal, and Plaid templates, bringing TEMPLATE_PROVIDERS to 32 named providers
- •New verifiers: verifyDocuSignSignature, verifyAdyenSignature, and verifyPayPalSignature with PayPal certificate URL validation and RSA-SHA256 verification
- •New detection helpers: isDocuSignWebhook, isAdyenWebhook, isPayPalWebhook, and isPlaidWebhook; Plaid remains template-only for verification
MCPv1.7.0
4 New Providers
- •DocuSign, Adyen, PayPal, and Plaid are available in provider template tools through the SDK catalog; verify_signature now exposes DocuSign, Adyen, and PayPal while keeping Plaid template-only
Web Appv0.23.1
Fix: send-webhook templates for newer providers
- •Fixed the dashboard send-webhook dialog failing with “Unsupported template "custom"” for 14 providers (HubSpot, Square, Meta, Lemon Squeezy, Coinbase Commerce, Razorpay, Cal.com, Intercom, Telegram, Mailgun, Calendly, Mux, Sentry, Bitbucket) — their template presets now derive from the SDK provider metadata so every listed provider can send a signed test webhook
Web Appv0.23.0
Agent Registration — sandbox, claim codes, SMTP email
- •Unclaimed agent credentials now work immediately in a bounded sandbox: an anonymous key can create ephemeral endpoints and read only its own captured requests, with strict cross-tenant isolation, before a human claims it
- •Anonymous registrations get a short human-friendly claim code (e.g. ABCD-EFGH) alongside the claim link — a signed-in user can claim by typing the code at /agent/claim
- •Verification emails (OTP) now send over SMTP in production (SMTP → Resend → dev fallback); local dev and tests keep using the in-process capture transport
- •Documented the ID-JAG trusted-provider config format and added an identity-provider onboarding section to the hosted /auth.md
SDKv1.8.0
Agent self-registration on-ramp
- •New static WebhooksCC.register helpers let an agent obtain its own credential before it has one: anonymous (with claim code + poll/waitForClaim), verified_email (withEmail + confirmEmailOtp), and identity_assertion (withIdJag)
- •WebhooksCC.describeRegistration() and client.describe().registration surface the auth.md on-ramp so an unauthenticated agent can discover how to register
- •Standalone exports (registerAnonymous, registerWithEmail, confirmEmailOtp, registerWithIdJag, pollClaim, waitForClaim) plus an AgentRegisterError carrying the auth.md error code
MCPv1.6.0
Agent self-registration on-ramp
- •New unauthenticated tools — how_to_register, register_agent, and check_claim — let an agent with no API key learn the auth.md flows and drive the anonymous register + claim handshake
- •The MCP server now boots without WHK_API_KEY, exposing only the registration on-ramp so an agent can obtain a credential instead of failing to start
- •describe now includes the registration on-ramp block from the SDK
Web Appv0.22.0
Agent Registration — auth.md (anonymous, verified email, ID-JAG)
- •Implements the WorkOS auth.md agent-registration protocol: agents self-register a credential anonymously, via a verified-email one-time code, or by presenting a provider-signed ID-JAG identity assertion
- •Adds RFC 9728 discovery (/.well-known/oauth-protected-resource and /.well-known/oauth-authorization-server), a hosted /auth.md, and a WWW-Authenticate hint on 401s so agents can discover how to authenticate
- •Anonymous credentials can be claimed by a signed-in user from an in-app claim page, permanently attaching the key to their account
- •Supports provider-driven revocation (logout token) for ID-JAG-issued credentials
Web Appv0.21.0
7 New Providers — Square, HubSpot, Mailgun, Calendly, Mux, Sentry, Bitbucket
- •Provider catalog grows from 21 to 28: added Square, HubSpot, Mailgun, Calendly, Mux, Sentry, and Bitbucket across templates, auto-detection, and signature verification
- •Three new signing schemes are now supported server-side: URL + body (Square), HTTP method + URI + body + timestamp (HubSpot), and body-embedded signature fields (Mailgun)
- •Endpoint settings, the send-webhook dialog, and the Signature tab list all 28 named providers; automatic server-side verification works for every one except SendGrid (IP allowlisting)
- •Refreshed provider template and signature-verification docs with payload shapes, headers, and algorithms for each new provider
Web Appv0.20.4
7 New Providers — Meta, Lemon Squeezy, Coinbase Commerce, Razorpay, Cal.com, Intercom, Telegram
- •Provider catalog grows from 14 to 21: added Meta (WhatsApp/Messenger/Instagram), Lemon Squeezy, Coinbase Commerce, Razorpay, Cal.com, Intercom, and Telegram across templates, auto-detection, and signature verification
- •Endpoint settings, the send-webhook dialog, and the Signature tab now list all new providers; server-side automatic verification works for every one
- •Refreshed provider template and signature-verification docs with payload shapes, headers, and algorithms for each new provider
SDKv1.7.0
7 New Providers — Square, HubSpot, Mailgun, Calendly, Mux, Sentry, Bitbucket
- •Added Square, HubSpot, Mailgun, Calendly, Mux, Sentry, and Bitbucket to templates, detection, and verification — the catalog now covers 28 named providers
- •New verifiers: verifySquareSignature, verifyHubSpotSignature, verifyMailgunSignature, verifyCalendlySignature, verifyMuxSignature, verifySentrySignature, verifyBitbucketSignature
- •New detection helpers: isSquareWebhook, isHubSpotWebhook, isMailgunWebhook, isCalendlyWebhook, isMuxWebhook, isSentryWebhook, isBitbucketWebhook
- •VerifySignatureOptions gains an optional method field; Square and HubSpot verification require the request url (HubSpot also uses the method and rejects timestamps older than 5 minutes)
- •Bitbucket is detected on x-event-key before Intercom to avoid the shared x-hub-signature collision (Bitbucket sha256=, Intercom sha1=)
SDKv1.6.0
7 New Providers
- •Added Meta (WhatsApp/Messenger/Instagram), Lemon Squeezy, Coinbase Commerce, Razorpay, Cal.com, Intercom, and Telegram to templates, detection, and verification
- •New verifiers: verifyMetaSignature, verifyLemonSqueezySignature, verifyCoinbaseCommerceSignature, verifyRazorpaySignature, verifyCalSignature, verifyIntercomSignature, verifyTelegramSignature
- •New detection helpers: isMetaWebhook, isLemonSqueezyWebhook, isCoinbaseCommerceWebhook, isRazorpayWebhook, isCalWebhook, isIntercomWebhook, isTelegramWebhook
- •Meta is detected by body shape (ordered before GitHub); Intercom (sha1=) is disambiguated from GitHub's x-hub-signature-256 and Bitbucket's sha256=
MCPv1.5.0
7 New Providers — Square, HubSpot, Mailgun, Calendly, Mux, Sentry, Bitbucket
- •Square, HubSpot, Mailgun, Calendly, Mux, Sentry, and Bitbucket are now available in send_webhook, send_to, preview_webhook, list_provider_templates, and verify_signature — wired automatically through the SDK provider lists, bringing the catalog to 28 named providers
MCPv1.4.2
7 New Providers
- •Meta, Lemon Squeezy, Coinbase Commerce, Razorpay, Cal.com, Intercom, and Telegram are now available in send_webhook, send_to, preview_webhook, list_provider_templates, and verify_signature — wired automatically through the SDK provider lists
Web Appv0.20.3
CLI v1.1.2 Release
- •Ships the CLI v1.1.2 polish — correct version display in `whk update` and a clear, actionable message when the install directory isn't writable
CLIv1.1.2
Update Command Polish
- •`whk update` now displays the current version correctly (was rendering as `vv1.0.0` due to a double `v` prefix)
- •When the install directory isn't user-writable, `whk update` fails fast with a clear message naming the path and suggesting `sudo whk update` or a user-writable reinstall — instead of the cryptic `Permission denied (os error 13)` after a multi-MB download
Web Appv0.20.2
MCP v1.4.1 & CLI v1.1.1 Release
- •MCP and CLI version bumps ship transitive dependency upgrades — zod 4 in MCP, tokio 1.52 and rustls-webpki refresh in the CLI
CLIv1.1.1
Dependency Maintenance
- •tokio 1.51 → 1.52, rustls-webpki refresh, axum 0.8.9, rand 0.8.6, clap 4.6.1, clap_complete 4.6.5, open 5.3.5 — picks up upstream security fixes
- •Internal clippy 1.95 cleanups in the TUI event loop and update screen (no behavior change)
MCPv1.4.1
zod 4 Upgrade
- •Upgrades the zod dependency from 3.x to 4.x with the matching tool-schema adaptation in src/tools.ts
Web Appv0.20.1
CI hardening & lint cleanup
- •CI: Build Web App job now uses placeholder env values when Supabase secrets aren't available (e.g. Dependabot PRs), so dependency-update PRs get a meaningful build signal
- •Resolved new strict react-hooks lint errors surfaced by an upcoming plugin bump, keeping the workspace lint-clean across plugin versions
Web Appv0.20.0
Provider Auto-Detect & Typeform Support
- •Dashboard auto-detects the webhook provider from headers and payload and renders a colored provider badge on each request
- •Provider icons (Stripe, GitHub, Shopify, Twilio, Slack, Paddle, Linear, Clerk, Discord, Vercel, GitLab, Typeform, and more) across the request list and detail panes
- •Typeform added to provider templates and signature verification — configure on any endpoint
- •Hardened signing configuration invariants: partial or stale provider state is no longer possible, eliminating a class of silent verification failures
- •Refreshed provider docs, ngrok and webhook.site comparison guides, signature verification guide, and MCP tools reference
SDKv1.5.0
Typeform Provider & Webhook Auto-Detect
- •Typeform provider templates (form_response, partial_response, payment) and verifyTypeformSignature
- •detectWebhookInfo() and detectWebhookProvider() helpers for provider auto-detection from headers and body
- •DetectedWebhookInfo type and isTypeformWebhook detection helper
MCPv1.4.0
Typeform Provider Support
- •Typeform exposed in list_provider_templates with templates, default event, and signature metadata
- •Typeform usable in create_endpoint and update_endpoint signing config
Web Appv0.19.1
Guest Dashboard SEO Overhaul
- •Fixed layout bug on /go where hero copy rendered above the navbar
- •Added feature cards flanking the Send Your First Webhook widget — mock responses, signature verification, CLI tunnel, SDK testing, MCP, and search/replay — visible without scrolling on xl+ screens
- •Expanded server-rendered SEO content (14 internal doc links, 12 headings, 751 words, BreadcrumbList + FAQPage schemas, hreflang alternates)
- •Promoted the page h1 to a visible subtitle inside the nav on md+ screens
CLIv1.1.0
Signature Verification
- •Tunnel forwards X-Signature-Verified, X-Signature-Provider, and X-Signature-Error headers
- •Listen shows inline verification status (checkmark/cross) per request
- •Create supports --signing-provider and --signing-secret flags (or WHK_SIGNING_SECRET env var)
SDKv1.4.0
Signature Verification Matchers
- •matchVerified() and matchUnverified() matchers for signature verification assertions
- •signatureVerified, signatureError, and signingProvider fields on Request and Endpoint types
MCPv1.3.0
Signature Verification Tools
- •Signing config (provider + secret) on create_endpoint and update_endpoint
- •verify_signature tool returns stored server-side results with skipped detection
- •Discord publicKey support for Ed25519 verification
Web Appv0.19.0
Signature Verification
- •Server-side webhook signature verification for 13 providers — configure once per endpoint, every request verified automatically
- •New Signature tab in request detail: paste a secret for instant client-side verification, or view stored server-side results with detailed error diagnostics
- •Verification badges (shield icons) in the request list and summary bar for at-a-glance valid/invalid status
- •Signing configuration section in endpoint settings: provider dropdown, encrypted secret storage, provider-specific tips
- •SDK: matchVerified() and matchUnverified() matchers for test assertions
- •MCP: verify_signature returns stored results without needing a secret; create/update endpoints with signing config
- •CLI: X-Signature-Verified headers on tunnel, verification status in listen output, --signing-provider/--signing-secret on create
Web Appv0.18.3
Blog Resilience & Housekeeping
- •Blog pages gracefully fall back when Supabase is unreachable instead of erroring
- •Added SECURITY.md and CODE_OF_CONDUCT.md for open-source governance
Web Appv0.18.2
SDK v1.3.0 & MCP v1.2.0 Release
- •Updated llms.txt and llms-full.txt with conditional response rules documentation
- •SDK and MCP version bumps for response rules and provider consolidation
Web Appv0.18.1
Blog Page Redesign
- •Redesigned blog index with clear visual hierarchy: featured post, two latest cards, and a scannable list for all posts
- •Compact page header replacing the bulky hero section
- •Fixed blog posts not appearing after publish due to stale Next.js fetch cache
Web Appv0.18.0
Conditional Response Rules
- •Define ordered response rules that match on method, path, headers, or body — first match wins
- •Visual response rules editor in endpoint settings with drag-to-reorder
- •Rules evaluated in the Rust receiver for low-latency conditional responses
- •Full SDK, MCP, and API support for managing response rules
SDKv1.3.0
Response Rules & Provider Consolidation
- •ResponseRule and ResponseRuleCondition types for conditional mock responses
- •validateResponseRules() and validation constants exported for shared use
- •TEMPLATE_PROVIDERS, VERIFY_PROVIDERS, and buildTemplateSendOptions exports — single source of truth for provider logic
- •Notification URL support in create/update endpoint options
- •Raw body replay with byte-exact fidelity (base64-decoded bodyRaw)
MCPv1.2.0
Response Rules & Notifications
- •Response rules support in create_endpoint and update_endpoint tools
- •Notification URL parameter for endpoint creation and updates
- •Provider lists imported from SDK — single source of truth
Web Appv0.17.4
SEO & Accessibility Improvements
- •Custom 404 page, OG image optimization (PNG→JPG), and improved sitemap generation
- •Comprehensive structured data (JSON-LD) and meta tag improvements across all pages
- •LLMs-full.txt for AI agent discoverability
Web Appv0.17.3
Configurable Limits & Security Hardening
- •Endpoint creation rate limits, ephemeral caps, and receiver body size now configurable via env vars
- •Stored XSS regression test suite for endpoint names, mock responses, and request data
Web Appv0.17.2
Teams Module Refactor
- •Atomic team invite acceptance with member limit enforcement (max 25)
- •Split teams module into focused sub-modules for better maintainability
Web Appv0.17.1
Consolidated Provider Logic
- •Unified webhook provider lists, signing, and payload generation via SDK — single source of truth
- •Added standard-webhooks provider to Send Webhook dialog (fixes drift from SDK/MCP)
- •Shared mock response validation across endpoint routes using SDK constants
Web Appv0.17.0
Redis-Backed Rate Limiting
- •Distributed rate limiting via Redis sliding window for all API routes
- •Receiver notification deduplication backed by Redis
- •Graceful fallback to in-memory rate limiting when Redis is unavailable
Web Appv0.16.0
Raw Body Fidelity & Search Performance
- •Raw body storage for non-UTF-8 payloads preserves byte-exact fidelity
- •Trigram-indexed full-text search across request path, body, and headers
- •Improved SSE streaming with raw body support
- •SDK version drift fix and accurate Retry-After headers
Web Appv0.15.0
Notification Webhooks
- •Configure a notification URL on any endpoint to receive POST alerts when webhooks are captured
- •Supports Slack, Discord, Microsoft Teams, and any webhook-compatible service
- •Notification URL management in endpoint settings and via API/SDK/MCP
- •New docs page for notification webhooks
Web Appv0.14.1
API Key Deletion Confirmation
- •Added confirmation dialog before deleting API keys to prevent accidental revocation
CLIv1.0.0
Rust Rewrite
- •Complete rewrite from Go to Rust for faster startup and smaller binaries
- •Full feature parity: tunnel, listen, auth, endpoints, requests, replay, send, update
- •Interactive TUI with ratatui (search, endpoint detail, request viewer)
- •Request search and filtering in TUI
- •Send webhooks with provider template signing from TUI
Web Appv0.14.0
API Explorer & Rate Limiting
- •Interactive API explorer at /api-explorer powered by Scalar
- •OpenAPI 3.1.0 specification at /openapi.yaml
- •Improved rate limiting with sliding window and informational headers
- •SDK error messages now include rate limit details and Retry-After hints
SDKv1.2.1
Rate Limit Metadata
- •RateLimitError now includes limit, remaining, and reset fields
- •New RateLimitMeta type export
Web Appv0.13.1
Pricing Copy Updates
- •Updated pricing copy across comparison pages and docs
- •Teams highlighted as Pro-exclusive feature
Web Appv0.13.0
Teams
- •Create and manage teams with invite-based membership
- •Share endpoints with team members
- •Team roles: owner and member with scoped permissions
- •Endpoint switcher shows personal and team endpoints
- •Teams documentation page
CLIv0.6.0
Teams Support
- •Endpoint list shows owned and team-shared endpoints
- •TeamShare metadata in endpoint responses
SDKv1.2.0
Teams Support
- •TeamShare type for endpoint team metadata
- •Endpoint type includes sharedWith and fromTeam fields
Web Appv0.12.1
Comparison Pages Expansion
- •New comparison pages: Hookdeck, localtunnel, RequestBin, Smee
- •Redesigned Beeceptor, ngrok, and Webhook.site comparison pages
- •Shared comparison CTA component
Web Appv0.12.0
Request Debugging Tools
- •Pin requests to keep them visible across endpoint switches
- •Add notes to captured requests (stored locally)
- •Side-by-side request diff comparison
- •Visual request timeline view
- •Interactive dashboard guide
- •Dashboard features documentation page
Web Appv0.11.0
Dashboard Improvements
- •Keyboard shortcuts for dashboard navigation
- •Collapsible JSON tree viewer for request bodies
- •JSON to TypeScript type generation
- •Resizable split pane in request viewer
- •Richer request list rows with method badges and size
Web Appv0.10.1
Case-Insensitive Slugs
- •Endpoint slugs are now case-insensitive (e.g. /w/AbC and /w/abc resolve to the same endpoint)
Web Appv0.10.0
Conversion Funnel & Live Preview
- •Live webhook preview on landing page
- •Getting started guide for new users
- •Claim ephemeral endpoints after signing in
- •Site stats social proof on landing page
- •Pricing CTA and docs CTA components
- •Redesigned hero and navigation
Web Appv0.9.3
Docs Expansion
- •REST API reference documentation page
- •Plans & limits documentation page
- •Webhook.site vs webhooks.cc comparison page
- •Docs navigation restructure and consistency improvements
Web Appv0.9.2
Changelog & Version Display
- •Public changelog page at /changelog with track filtering
- •Version display on account page
- •Deep health check endpoint for AppSignal uptime monitoring
- •Forward user IP on test webhook sends
- •Status page link in footer
Web Appv0.9.1
Provider Templates & Mock Response Delay
- •Add SendGrid, Clerk, Discord, Vercel, GitLab provider templates (12 total)
- •Configurable response delay for mock responses (0-30s)
- •Comprehensive analytics tracking for request and endpoint operations
- •New provider template reference documentation page
SDKv1.1.0
New Provider Templates
- •Add SendGrid, Clerk, Discord, Vercel, GitLab provider templates
- •Detection helpers: isSendGridWebhook, isClerkWebhook, isVercelWebhook, isGitLabWebhook
- •Signature verification: verifyClerkSignature, verifyVercelSignature, verifyGitLabSignature
- •Mock response delay field
MCPv1.1.0
New Provider Templates
- •Add SendGrid, Clerk, Discord, Vercel, GitLab to template and verify providers
- •Mock response delay support
Web Appv0.9.0
AppSignal & Next.js 16 Proxy
- •Replace Sentry with AppSignal for EU data residency compliance
- •OpenTelemetry tracing pipeline for Rust receiver
- •Migrate Next.js middleware.ts to proxy.ts (Next.js 16)
- •Proxy test webhook sends through server-side API route
CLIv0.5.3
Tunnel Base Path & TUI Fixes
- •Support base path in tunnel target (e.g. whk tunnel 8080/api/webhooks)
- •Fix TUI tunnel input swallowing shortcut-bound keys
CLIv0.5.2
Custom Headers
- •Add -H/--header flag for injecting custom headers in tunnel forwarding
SDKv1.0.1
Proxy & Delay
- •Mock response delay field support
- •Minor type and documentation fixes
MCPv1.0.1
Delay & Fixes
- •Mock response delay support in update_endpoint tool
- •Minor schema fixes
Web Appv0.8.0
Docs Overhaul
- •14 new documentation pages with MDX pipeline
- •Standard Webhooks provider and sendTo method
- •Dynamic blog system with API publishing
- •PostHog analytics integration
- •Receiver file logging with daily rotation
- •Adjusted tier quotas (guest 25/12hrs, free 50/day, pro 100K/month)
SDKv1.0.0
Stable API
- •WebhookFlowBuilder for multi-step test scenarios
- •Request export (JSON, HAR) and clear methods
- •Full-text search and count queries
MCPv1.0.0
Stable API
- •Standard Webhooks provider support
- •Batch endpoint create/delete tools
- •Request export, search, and clear tools
- •Setup commands for Cursor, VS Code, Windsurf, Claude Desktop, Codex
SDKv0.6.0
Build Request & Fixes
- •buildRequest method for constructing signed webhook requests
- •Fix raw secret detection for Standard Webhooks
- •Request diffing (diffRequests)
SDKv0.5.0
Standard Webhooks & sendTo
- •Standard Webhooks provider and sendTo method
- •matchContentType, matchQueryParam, matchBodySubset matchers
- •Provider template sending with signed headers
MCPv0.3.0
Signature & Templates
- •verify_signature tool for 9 providers
- •send_webhook with provider template signing
- •compare_requests and extract_from_request tools
Web Appv0.7.4
SEO & Navigation Refresh
- •Refresh site metadata and navigation layout
- •Fix sitemap response content
Web Appv0.7.3
Webhook Templates & Retention
- •Signed webhook templates (Stripe, GitHub, Shopify, Twilio, Slack, Paddle, Linear)
- •Request retention policy improvements
- •Homepage comparison section
SDKv0.4.0
Signature Verification
- •verifySignature for Stripe, GitHub, Shopify, Twilio, Slack, Paddle, Linear
- •Webhook templates with realistic payloads
MCPv0.2.0
Webhook Templates
- •Provider template support in send_webhook
- •list_provider_templates tool
CLIv0.5.1
Replay & Ephemeral
- •Add whk replay command to resend captured requests
- •Add --ephemeral flag for auto-deleting tunnel endpoints
Web Appv0.7.2
SEO & Search
- •Structured data (JSON-LD), FAQ section, breadcrumbs
- •Add llms.txt for AI discovery
- •Full-text search across request body, headers, and path
- •Paginated request history with retention policies
SDKv0.3.0
SSE Streaming
- •subscribe() SSE async iterator for real-time streaming
- •describe() introspection for AI agents
MCPv0.1.0
Initial Release
- •11 tools: create/list/get/update/delete endpoints, list/get requests, send/wait/replay, describe
- •stdio transport via @modelcontextprotocol/sdk
- •Setup CLI for Cursor, VS Code, Windsurf, Claude Desktop
Web Appv0.7.0
Rust Receiver & CLI TUI
- •Rewrite webhook receiver from Go to Rust (Axum + sqlx + Tokio)
- •Optimize database with stored procedures (capture_webhook())
- •Guest live dashboard for unauthenticated users
- •Strict quota enforcement for all endpoint types
CLIv0.5.0
TUI Mode
- •Interactive TUI with menu, auth, endpoint listing, and request detail views
- •Real-time SSE subscriptions in TUI
Web Appv0.6.0
Production Hardening
- •Six phases of production hardening (abuse protection, CSP, rate limiting)
- •Integration test suite (42 test cases)
- •SEO metadata, sitemap improvements, crawler exclusions
CLIv0.4.0
Device Auth
- •Browser-based device authentication flow
- •whk update self-update with SHA256 verification
SDKv0.2.0
Matchers & Helpers
- •Composable request matchers (matchMethod, matchHeader, matchBodyPath, matchAll, matchAny)
- •Provider detection helpers (isStripeWebhook, isGitHubWebhook, etc.)
- •parseJsonBody, parseFormBody, extractJsonField helpers
Web Appv0.5.0
Security & Docs
- •Security hardening across backend, API routes, and CLI
- •Floating navbar, sidebar, and docs improvements
CLIv0.3.0
Cosign Signing
- •Cosign keyless signing for release binaries
SDKv0.1.0
Initial Release
- •Endpoint CRUD (create, get, list, delete, update)
- •Request list, waitFor with timeout and polling
- •Replay captured requests to any URL
- •Human-readable duration strings (30s, 5m)
Web Appv0.4.0
Public Pages
- •Installation page with copy-paste commands
- •Privacy policy and terms of service pages
- •XML sitemap generation
CLIv0.2.0
Initial Release
- •whk tunnel for forwarding webhooks to localhost
- •whk listen for streaming requests to terminal
- •whk create, list, delete for endpoint management
Web Appv0.3.0
Billing & Polish
- •Polar.sh subscription management (free/pro tiers)
- •Request batching and endpoint caching for high-throughput
- •Dashboard UI improvements (empty states, layout fixes)
Web Appv0.2.0
CI/CD & Code Quality
- •CI pipeline with lint, typecheck, build, and test stages
- •Dependabot and CodeQL security scanning
- •Input validation, CSP, and rate limiting
Web Appv0.1.0
Initial Release
- •Dashboard with webhook capture and real-time inspection
- •GitHub and Google OAuth authentication
- •Basic endpoint CRUD and request viewer