Skip to content
webhooks.cc

Changelog

Web v0.62.5CLI v1.8.0SDK v1.21.0Python v0.5.0Go v0.5.0MCP v1.17.0
Web Appv0.62.5

More Accurate Email Parsing

  • •The MIME boundary text appearing in the middle of a line no longer cuts the rest of that part of the email off
  • •An email that forwards several messages as attachments lists each one, not one merged attachment
  • •A header whose name only looks like From or Subject (with a space or control character inside it) is no longer read as the real one
  • •The last characters of base64 attachments without padding, and of UTF-7 and UTF-16 text, are no longer dropped
  • •A text or HTML part marked as an attachment, or a text part with a file name of its own, is listed with the attachments instead of being added to the message text
  • •Captured email with large attachments is parsed faster
Web Appv0.62.4

Fresher robots.txt on mailhooks.cc

  • •mailhooks.cc's robots.txt is cached for four hours instead of a year, so changes to it reach search engines the same day
Web Appv0.62.3

Sitemaps Search Engines Can Read

  • •robots.txt on webhooks.cc and mailhooks.cc also lists a copy of each sitemap that Google reads, so new pages are found sooner
  • •Each site's sitemap is also served as plain text (/sitemap.txt) and as an RSS feed (/sitemap.rss), two more formats search engines accept
Web Appv0.62.2

API Read Counts in Usage Analytics

  • •The daily usage counts now include how often each kind of client (CLI, SDKs, MCP servers) read data through the API, counted per day and never per call. The privacy policy says so
Web Appv0.62.1

Two-Factor Fixes: Recovery Codes and Site Switching

  • •Turning on two-factor sign-in shows your ten recovery codes again. They were made but the page reloaded before showing them; make new ones under Account > Security if you never saw yours
  • •Signed-in pages no longer flash "Loading" and start over when your session renews in the background, about once an hour
  • •Switching between webhooks.cc and mailhooks.cc no longer asks for your two-factor code again: a session that passed it carries that over to the other site
Web Appv0.62.0

Support Tickets and Two-Factor Sign-In

  • •Support has tickets. Signed in on webhooks.cc or mailhooks.cc, open one from Support (in the account menu, the dashboard's guide menu and the account pages), follow the answer there, and add screenshots. The ticket shows whose turn it is, and support's replies arrive by email too unless you untick that
  • •Support never sees what you capture unless you allow it: tick "Let support view my account" on a ticket and support can read your endpoints, requests and emails, read-only, until 7 days after the ticket closes. Withdraw it at any time; every time support looks is listed under Account > Support access
  • •A ticket waiting on your answer gets a reminder after 3 days and closes after 7. Answer within 30 days of a close and it opens again. Rate how we did when it closes
  • •Two-factor sign-in: turn on an authenticator app under Account > Security, and every new sign-in asks for its code. You get ten recovery codes when you turn it on; if you lose the authenticator, one of them signs you in and turns two-factor off so you can set it up again
Web Appv0.61.0

Refunds for Charges That Bought Nothing

  • •A charge that bought nothing is now set aside for a refund to the card it came from: a second plan or extra-domains subscription from a checkout completed twice, an add-on paid for an account or team that was deleted meanwhile, and extra domains paid for after their subscription had ended
  • •A plan or team subscription whose checkout completed after its account or team was deleted is now ended instead of charging every month, and set aside for a refund
Web Appv0.60.0

Deliverability Report for Every Email

  • •The Authentication tab of an email now has a deliverability report: what Gmail, Yahoo and Outlook would hold against it, each item marked as fine, worth improving, or to fix, and a badge in the email header that sums it up
  • •Domain setup, as it was when the email arrived: SPF records and how they end, the DNS lookups SPF takes with its includes (it fails past 10), the DMARC policy, reports and alignment with the From domain, DKIM key sizes and SHA-1 signatures, and a BIMI logo
  • •The sending server: reverse DNS, whether its HELO name resolves to it, and TLS. The message: From, Message-ID, Date and Subject, a plain-text part, one-click unsubscribe, links whose text names another site, link shorteners, mostly-image emails, and HTML large enough for Gmail to clip
  • •Forwarded mail now has its ARC chain checked, so the tab shows which servers it passed through and whether they sealed what they received
  • •Like the spam score, none of it decides whether mail is captured, and links are never opened to check them, so sign-in and confirmation links stay unused
Web Appv0.59.6

Invoices and Payment Method

  • •Invoices and payment method, on the plan page, opens your Polar customer portal: download invoices and receipts and change the card on file. Team owners find it under Billing on the team page
  • •After a failed payment, the notices on the plan, team and domains pages now open the portal to update the payment method, instead of pointing to a Polar receipt email
Web Appv0.59.5

Annual Plans Reset on the Day They Started

  • •An annual plan that started on the 29th, 30th or 31st now resets its monthly quota on that day in every month that has it, instead of moving to the 28th after February and staying there
  • •The last monthly quota of an annual plan now ends exactly when the year renews, so usage resets once at the renewal, not twice a few days apart. An annual plan from before this release moves back to its day at its next reset, with that one quota period lasting a few days longer
  • •Monthly add-ons on such a plan go back to renewing on the plan's day after a short month
Web Appv0.59.4

Comparisons and Docs Brought Up to Date

  • •The comparison pages are checked again against each tool's own site: RequestBin's home, Pipedream Workflows, takes no new signups and closes on March 31, 2027; Beeceptor now has a CLI tunnel and an MCP server; ngrok has an MCP server; Webhook.site has an open-source edition. The checklist gains a row for inbound email
  • •The comparisons also describe webhooks.cc as it is now: SDKs for TypeScript, Python and Go, forwarding to up to 10 destinations with filters, throttling and retries, response rules, email parsing on mailhooks.cc, the remote MCP server and Team Business
  • •The docs, the home page, the email and teams pages, llms.txt and llms-full.txt are brought up to date: destinations, layouts, Python and Go, CLI commands and flags that were missing, the API's newer fields, 48 MCP tools, and Devin Desktop (formerly Windsurf) in the MCP setup
  • •The docs Quick Start sends an email as well as a webhook, and only pages added in the last few weeks are marked new in the docs sidebar
  • •Pro's 100,000 requests and each Teams seat's 100,000 are described as a month everywhere, and the plan comparison under Account > Plan shows Business's 250 AI assists instead of 500
  • •The keyboard shortcuts dialog lists 5 for the Signature tab
  • •AI setup says when your next assist comes back. Assists count for 30 days from when each was used rather than resetting with the billing period, and the line under AI setup used to give only the count
Web Appv0.59.3

Testing Guides for Python and Go

  • •Two new testing guides in the SDK docs: Python + pytest and Go + go test. Each tests a service from both sides: the webhooks it sends, its webhook handler with Stripe-signed requests and no network or API key, its retries against an endpoint that answers 503, and the confirmation codes in the emails it sends, with a CI job to run it all
Web Appv0.59.2

webhooks.cc/go Opens the Go SDK Docs

  • •Opening webhooks.cc/go, the Go SDK's import path, in a browser now shows the Go SDK docs instead of the home page. go get webhooks.cc/go works as before
Web Appv0.59.1

Team Business on the Pricing Section

  • •The pricing section on the home page shows the personal plans on one row and the team plans on the next: what a team is, Teams, and Team Business with its per-seat limits and yearly price
Web Appv0.59.0

Team Business Per Seat

  • •Team Business is now a team plan of its own, priced per seat: $35 a seat a month, or $350 a seat a year. Each seat brings Business's limits to the team's pool: 250,000 requests, 2,000 parsed attachment pages and 250 AI assists, with 90-day retention, up to 50 layouts per endpoint, a custom inbound domain and file drops for the endpoints shared with the team. It replaces the $49 add-on
  • •Pick Teams, or Team Business monthly or yearly, when the team subscribes, and change it on the team page. Moving up applies at once, and the dialog shows about what is charged now. From Teams to Team Business within the month, the extra requests and pages for the rest of the period come in the same proportion as the charge; a move to yearly starts a new year with a fresh allowance. Moving down waits for the renewal and can be undone until then
  • •A team on annual Team Business still gets a fresh allowance every month
  • •A missed Team Business payment no longer switches off its custom domain or extra pages while Polar retries the card
  • •Teams and Team Business start at 2 seats. Teams that already have one seat keep it
Web Appv0.58.5

Your Analytics Choice Follows Your Account

  • •Once you sign in, your answer to the analytics banner is saved to your account, so a new computer or browser does not ask again after you sign in there
  • •A decline applies on every device you sign in on, so withdrawing once withdraws everywhere. An accept only answers browsers where you have not chosen yet
Web Appv0.58.4

AI Setup on Sonnet

  • •AI setup and repair now runs on Claude Sonnet 5.5, which answers in about half the time. Every proposal is still tested on the emails you picked before you see it
  • •Business and Team Business include 250 AI assists every 30 days, down from 500. Free keeps 5 and Pro 20
Web Appv0.58.3

Docs Search Works Again

  • •Searching the docs finds pages again instead of saying search is only available in production builds. The search index was built but left out of the files the server reads
Web Appv0.58.2

Clients Named in Usage Counts

  • •Account activity counted on our servers now tells the TypeScript SDK, the npm MCP server and the remote MCP server apart from other Node.js clients, by the User-Agent they send from their next releases on. The CLI, the SDKs and the MCP servers keep their names when they use an agent's connection
Web Appv0.58.1

One Analytics Choice for Both Sites

  • •Switching between webhooks.cc and mailhooks.cc while signed in now takes your cookie banner choice along, so you are not asked again on the other site. An accept only answers a banner you have not answered there; a decline always comes along
Web Appv0.58.0

Your Choice on Analytics

  • •A cookie banner asks once, on each site, whether our analytics may keep an anonymous identifier in your browser. Decline, or do not choose, and visits are only counted, with nothing stored; Do Not Track and Global Privacy Control count as a decline. Cookie settings in the footer and the Privacy Policy change the choice at any time
  • •Analytics are for our own use only. We never sell or share them, and the Privacy Policy and the sign-in page now say so, along with what we record about how an account is used. They name an account by its id, never by its email address
  • •Addresses sent to analytics lose endpoint names, checkout tokens and every query parameter other than campaign ones, as well as share link tokens, and clicks in the parts of the dashboard that show your requests, emails and endpoint names are no longer recorded
  • •Account activity is now counted on our servers, whichever client it comes from (the dashboard, the API, the CLI, the SDKs, the MCP server or an agent), with daily usage counts per account. It never includes what your webhooks or emails contain
  • •Signups are no longer marked with a short-lived cookie
Web Appv0.57.0

Favourite Endpoints

  • •Click the star next to the endpoint switcher to mark the open endpoint as a favourite. Favourites are listed first in the switcher, and the dashboard opens your first favourite when you go to it without picking an endpoint
  • •Favourites are yours alone: on an endpoint shared with your team, each member keeps their own. They follow your account to every browser and to both webhooks.cc and mailhooks.cc
  • •The API reports `favorite` on every endpoint it lists and on Get endpoint, and `PUT` and `DELETE` on `/api/endpoints/{slug}/favorite` mark and unmark one. The remote MCP server gains a `favorite_endpoint` tool; the SDKs, the CLI and the npm MCP package follow in their next releases
Web Appv0.56.4

Switching Sites Leaves Their Endpoints Behind

  • •Switching between webhooks.cc and mailhooks.cc from the dashboard keeps the open endpoint only when the other site lists it. An endpoint listed on one site no longer stays open, and in the endpoint list, on the other; you land on that site's first endpoint instead
Web Appv0.56.3

Tabs From the Spreadsheet

  • •When you set up or edit a Google Sheets destination, the Tab field lists the tabs of the spreadsheet you chose and picks the first one if the tab set is not there, so a spreadsheet made in another language ("Ark1", "Hoja 1") works without retyping its name. Deliveries keep the saved tab: after renaming a tab in Google, open the destination and save it again
  • •A tab that is not in the spreadsheet is named in the error, with the tabs that are, instead of a bare 502
Web Appv0.56.2

Choose from Drive in Every Browser

  • •Choose from Drive, for Google Sheets destinations, opens Google's picker in a small window of its own, so it works in browsers that block third-party cookies, where it showed a blank page before
Web Appv0.56.1

Where Endpoints Are Listed, Everywhere

  • •The MCP tools reference covers the site an endpoint is listed on, now that the MCP server, the CLI and the Python and Go SDKs can set it
CLIv1.8.0

Favourite Endpoints

  • •`whk favorite <slug>` and `whk unfavorite <slug>` (also spelled `favourite` and `unfavourite`) mark and unmark an endpoint as one of your favourites; `whk list` and the TUI's endpoint list show favourites first, marked with a star
CLIv1.7.0

Parsed Emails

  • •whk requests get and the TUI's request detail show what an email's layout found: its fields, its line items as a table fitted to the terminal, and its parsed attachments
SDKv1.21.0

Favourites and a User-Agent

  • •`endpoints.favorite()` and `endpoints.unfavorite()` mark and unmark an endpoint as one of your favourites, and endpoints carry `favorite`
  • •Calls to the API send `User-Agent: webhooks-cc-sdk/<version>` outside browsers, and the `userAgent` option puts your own product token, like `my-tool/1.2`, in front of it. `WebhooksCC.sandbox()`, `connect()` and `fromSavedConnection()` take it too
SDKv1.20.0

Layouts, Attachments and Alerts

  • •`endpoints.update()` takes `layouts`, `retentionDays`, `deleteAfterDelivery` and `site`; `endpoints.previewLayouts()` tries layouts on a captured email before you save them, and a request's `parsed` holds what its layout found: fields, line items and parsed attachments
  • •`requests.raw()` downloads an email's exact message and `requests.attachment()` one of its attachments, with its name and type; `requests.redeliver()` and `endpoints.redeliver()` send captured requests through the destinations again
  • •`alerts.get()` and `alerts.update()` read and change an endpoint's alerts, and `destinations.create()` takes Google Sheets and file drop settings and how attachments travel
  • •`endpoints.create()` takes `site`, which site's dashboard lists the endpoint (`webhooks`, `mailhooks` or `both`, the default); placeholders read `{{ parsed.* }}`, and the inbound provider shapes carry attachment contents when the email has them
Python SDKv0.5.0

Favourite Endpoints

  • •`endpoints.favorite()` and `endpoints.unfavorite()` mark and unmark an endpoint as one of your favourites, and endpoints carry `favorite`
Python SDKv0.4.0

Layouts and Downloads

  • •`endpoints.update()` takes `layouts`, `retention_days`, `delete_after_delivery` and `site`, `endpoints.create()` takes `site`, and `endpoints.preview_layouts()` tries layouts on a captured email; a request's `parsed` holds what its layout found
  • •`requests.raw()` downloads an email's exact message and `requests.attachment()` one of its attachments, with its name and type
  • •Destinations read the `sheets` and `file_drop` formats
Go SDKv0.5.0

Favourite Endpoints

  • •`Endpoints.Favorite` and `Endpoints.Unfavorite` mark and unmark an endpoint as one of your favourites, and endpoints carry `Favorite`
Go SDKv0.4.0

Layouts and Downloads

  • •`Endpoints.Update` takes `Layouts`, `RetentionDays`, `DeleteAfterDelivery` and `Site`, `Endpoints.Create` takes `Site`, and `Endpoints.PreviewLayouts` tries layouts on a captured email; a request's `Parsed` holds what its layout found
  • •`Requests.Raw` downloads an email's exact message and `Requests.Attachment` one of its attachments, with its name and type
MCPv1.17.0

Favourite Endpoints

  • •`favorite_endpoint` marks an endpoint as one of your favourites, or unmarks it with `favorite: false`; `list_endpoints` and `get_endpoint` show `favorite`
  • •Calls to the API name the server in their User-Agent (`webhooks-cc-mcp/<version>`)
MCPv1.16.0

Layouts for Agents

  • •`preview_layouts` tries an endpoint's layouts on a captured email, and `update_endpoint` takes `layouts`; emails carry `parsed`, what their layout found, trimmed to fit the output budget
  • •`create_endpoint` and `update_endpoint` take `site`, which site's dashboard lists the endpoint
Web Appv0.56.0

One Account, Two Sites

  • •A switcher beside the name at the top of every page moves between webhooks.cc and mailhooks.cc, and keeps you signed in on the way
  • •An endpoint is listed on the site it was made on, or on both: choose when you create it, or later under Settings, Receiving. Its HTTP URL and email address work either way
  • •Endpoints made before are listed on both sites, and so are those made through the API, the SDKs, the CLI or the MCP server unless they name a site
  • •The API and the TypeScript SDK take a site when creating or updating an endpoint
Web Appv0.55.4

Attachments Parsed Without Waiting

  • •Emails on an endpoint whose layout reads or parses attachments are parsed and delivered right away again, instead of waiting for minutes
  • •The layout preview answers in moments for an email with attachments, instead of after 30 seconds
Web Appv0.55.3

Business, Told in Full

  • •The pricing pages and the plan page name everything Business adds: attachment parsing, more layouts, custom inbound domains, file drops, AI assists and longer retention
  • •mailhooks.cc has pages for the Google Sheets destination, file drops, custom domains, AI setup, and Zapier and Make, and the docs have a page for Zapier and Make
  • •A Google Sheets destination or file drop writing a row per line item leaves the item columns blank for an email with none, instead of their placeholders
  • •Alerts settings wait until they have loaded before they can be changed, so a change made right away is no longer undone
  • •When a Business renewal payment fails, the plan page says Business is at stake, not Pro
  • •The privacy policy says where the original message and attachments of a captured email are kept: object storage on our own server in Denmark
Web Appv0.55.2

Endpoint Retention in Every View

  • •An endpoint set to keep its requests fewer days than your plan hides older ones at once, in the dashboard, the API and search, instead of showing them until the next cleanup
Web Appv0.55.1

Destinations That Are Gone

  • •A destination whose URL answers 410 Gone is turned off instead of being retried with every email; turn it on again once the URL works
  • •Rendered email JSON (the samples integrations show) includes attachment download links, as deliveries do
  • •Rate limits on destinations, test emails and rendering count per account, so integrations that share addresses do not slow each other down
Web Appv0.55.0

AI Setup and Repair

  • •Draft a layout, or find a field, from a few of your emails: AI proposes the patterns, and only those that find a value in every email you picked are shown
  • •When an alert says a field stopped matching, fix it with AI from the latest emails, under the field's own name
  • •Opt in each time: the emails you pick (never their attachments) go to Anthropic only when you ask; 5 assists every 30 days on Free, 20 on Pro and Teams, 500 on Business
Web Appv0.54.0

File Drops

  • •File drops on Business: write each email (or each batch of them) as a CSV, XML or JSON file to your SFTP, FTPS, FTP or S3-compatible server, for systems that watch a folder
  • •CSV and XML files use the same columns as Google Sheets, a row per email or per line item; JSON files hold each email with its parsed fields
  • •Files are written under a temporary name and renamed when complete, the SFTP host key is pinned on the first connection, and passwords and keys are stored encrypted and never shown again
Web Appv0.53.0

Custom Inbound Domains

  • •Receive mail at your own domain on Business: add it under Account > Domains, prove it with a TXT record, point its MX at the mail host it shows, and send each address (or any address) to an endpoint
  • •Business includes one domain and Team Business one per team; extra domains are $3 a month each, renewed with your plan
  • •Domains are checked every day; mail to a domain whose records failed three checks in a row, or that is past what your plan allows, is refused
Web Appv0.52.0

mailhooks.cc and Ready-made Layouts

  • •mailhooks.cc is webhooks.cc with the mail first: the same account, endpoints and plans, a dashboard that opens on emails and leads with each endpoint's address
  • •Ready-made layouts for 13 kinds of email, from Shopify and WooCommerce orders to Booking.com reservations, Stripe receipts and CSV reports: Use this layout adds one to an endpoint
  • •Each site keeps its own sign-in; email links, checkouts and invites return to the site they were started on, and quota and alert emails link to the site you signed in on last
Web Appv0.51.0

Business Plan, Parsed Page Add-ons and Team Business

  • •Business, $29 a month or $290 a year: 250,000 requests a month, 90-day retention, 2,000 parsed attachment pages a month and up to 50 layouts per endpoint
  • •More parsed pages on Business: monthly blocks of 1,000 at $5, one-time blocks at $8 that never expire, or overage at $0.01 a page up to the most you set
  • •Moving from Pro to Business applies at once: you pay the difference for the rest of the period and get Business's extra requests and pages for that part of it; other plan changes wait for the renewal, and you can undo them until then
  • •Teams can add Team Business for $49 a month: 150,000 more requests in the pool, 2,000 pooled parsed pages, 50 layouts per endpoint and 90-day retention for shared endpoints
  • •Extra requests (monthly blocks, one-time blocks and overage) work on Business as on Pro
Web Appv0.50.0

Layouts: Parse Emails into Fields, Line Items and Rows

  • •Layouts read each sender's emails its own way: match conditions pick the layout, which finds its own fields and turns an order's products into line items, from the text or a spreadsheet attachment
  • •CSV, TSV, Excel, ODS, PDF text and text attachments are parsed into rows and text in a sandboxed parser; Free includes 20 parsed pages a month and Pro 100, and past them attachments arrive as files, unparsed
  • •The result is `parsed` in every email's JSON: on a new Parsed tab, in deliveries, templates (`{{ parsed.fields.order }}`), Google Sheets rows per line item, the API and the MCP tools
  • •Settings > Layouts tries your draft on a captured email as you type, without using pages; replay reads earlier emails again with the current layouts
  • •Alerts also fire when no layout matches the incoming mail; Google Sheets writes your header row only when you ask
Web Appv0.49.0

Attachments, Alerts, Google Sheets and Retention

  • •Email attachments are kept with the email: download them from the Attachments tab, and destinations send them as signed links or inline (base64, up to 1 MB per delivery)
  • •Alerts tell you by email, and in a chat or webhook destination if you like, when an endpoint's email fields stop matching, when mail stops arriving, or when deliveries to a destination fail for good
  • •Replay sends emails through their destinations again after you fix a pattern, from an open alert or through the API
  • •A Google Sheets destination adds a row per email or request, with the columns you choose; webhooks.cc only touches the spreadsheets it creates or you pick
  • •Every endpoint's owner can keep its requests for fewer days than the plan, or delete each one a minute after every destination has its copy or has given up
Web Appv0.48.6

Full Messages for Large Emails

  • •Captured emails are now kept whole in storage, so the Raw tab and the .eml download have the complete message even when it is larger than 1 MiB
  • •Groundwork for longer retention, shorter retention per endpoint and the coming Business plan; nothing changes for any plan today
Web Appv0.48.5

Pro Accounts Hear When Their Requests Run Out

  • •Pro accounts now get the email free accounts already got when webhooks start meeting a 429, offering the extra requests that keep them coming instead of an upgrade. It goes out once the plan's requests, monthly blocks, one-time blocks and overage are all used up, and at most once per billing period
Web Appv0.48.4

Smoother Paths for Agents

  • •The install script takes WHK_INSTALL_DIR, so whk installs without root to a directory you can write to (created when missing), with a PATH hint; the default /usr/local/bin and its sudo step are unchanged, and when sudo is missing the error names the option
  • •/auth.md, llms.txt, the agent and CLI docs, the installation page and the README give Homebrew and the no-root form next to the install script; the local testing guide had a wrong Homebrew tap and a Go command for a repository that does not exist
  • •A new agent access token reports expires_in 3600, its full lifetime, instead of 3599; a claim code reports what it has left, rounded down, and never more
  • •The homepage no longer says the CLI, SDKs and MCP server need a signup; AI agents can start with them without an account
  • •llms-full.txt lists every public route, the agent registration and OAuth ones included, and the CLI device-flow routes as they are; auth.md explains why the claim attempt id and the link's token differ; the guest column in the agent docs reads 25 requests in all, one endpoint
Web Appv0.48.3

The Remote MCP Server Comes First

  • •The remote MCP server at https://webhooks.cc/mcp is now the recommended way to connect any agent whose client takes remote servers, Claude Code, Cursor, VS Code and Codex included, not just claude.ai and ChatGPT: one approval in the browser, with no key to paste and no code to type
  • •/auth.md, llms.txt, llms-full.txt, the home page's markdown and FAQ, the agent skill, and the agent and MCP docs lead with it and give the setup line for each client; the local server and the agent sandbox stay as the fallback for sends to localhost, work without an account, and CI
  • •The installation page's MCP tab starts with the remote server for Claude Code, Codex, Cursor, VS Code and claude.ai, above the local server's setups
Web Appv0.48.2

Translated Pages Keep Working

  • •A page your browser translated (Chrome's built-in translation, for example) no longer breaks into an error screen when you open a menu, switch pages or something on it changes
Web Appv0.48.1

The Header Stays Put Under Open Menus

  • •Opening a select, menu or dialog on a scrolled page no longer moves the header out of view, for example the overage maximum on the plan page
MCPv1.15.1

Setup for Devin Desktop

  • •`npx @webhooks-cc/mcp setup devin` writes the user-level MCP config that Devin Desktop (formerly Windsurf) and the Devin CLI read, ~/.config/devin/mcp_config.json or %APPDATA%\devin\mcp_config.json on Windows; `setup windsurf` now does the same, and still updates ~/.codeium/windsurf where an older Windsurf is installed
  • •A Devin config that holds comments is left as it is, and setup prints the entry to add by hand instead of replacing the file
Web Appv0.48.0

A Remote MCP Server, and Easier Agent Onboarding

  • •A remote MCP server at https://webhooks.cc/mcp for hosted agents (claude.ai, ChatGPT, cloud coding agents) and any client that takes remote servers: add it as a custom connector and approve it once in your browser, with no key or code to copy. It speaks the MCP 2026-07-28 revision (stateless, per-request metadata, cached tool lists) and still serves clients on the 2025 revision. An API key works too, as a bearer header
  • •OAuth 2.1 behind it: the authorization code flow with PKCE, Client ID Metadata Documents and dynamic client registration, rotating refresh tokens, and iss in every authorization response. A connected app is listed under Connected agents, next to the agents you approved with a code, and disconnects the same way
  • •/auth.md starts with the shortest way in for each kind of agent (the remote server, the local MCP server, the Claude Code plugin, the Python, Node and Go SDKs and the CLI, or plain HTTP), and the agent docs, llms.txt and the agent skill say the same
  • •Discovery for agents: an Agent Skills index at /.well-known/agent-skills/index.json, an API catalog at /.well-known/api-catalog (RFC 9727) advertised in a Link header, the OAuth scheme and the agent routes in openapi.yaml, and markdown for the homepage and every docs page, at /index.md and /docs/<page>.md or with Accept: text/markdown
  • •The retired auth.md v0.1 routes tell old MCP servers and SDKs how to update
CLIv1.6.0

The Agent Sandbox

  • •whk sandbox create, list, get, delete, requests, request and wait capture webhooks without an account: whk registers on the first call (a second of proof of work) and keeps the sandbox for the next commands, all with --json for agents
  • •whk sandbox connect --email connects the agent to your account: it prints a link and a code (one JSON line with --json), waits until you enter it, and saves the connection
  • •Without a login, every command uses a saved agent connection, from whk, the MCP server or an SDK (~/.config/whk/agent.json); whk auth status says so
SDKv1.19.0

Agent Connections That Last

  • •`WebhooksCC.sandbox()` keeps the sandbox in the agent credential file (~/.config/whk/agent.json, shared with the MCP server, the CLI and the other SDKs) and reuses it on the next run instead of registering again; `credentialsFile: false` keeps it in memory
  • •`sandbox.waitForClaim()` saves the account connection, and `WebhooksCC.connected()` returns a client for it later, or null once the human disconnects the agent; `WebhooksCC.connect({ email })` connects an account without a sandbox
  • •A sandbox read back from the file connects its human through a new registration (`movesEndpoints: false`), since only the process that registered holds the claim token
  • •`fetch` option on the client, for proxies and tests; waits no longer sleep past their timeout
  • •The auth.md v0.1 helpers (`registerAnonymous`, `registerWithEmail`, `confirmEmailOtp`, `registerWithIdJag` and their `pollClaim`, `waitForClaim`) are deprecated and warn once; they go in the next major version
Python SDKv0.3.0

The Agent Sandbox

  • •`WebhooksCC.sandbox()` registers an agent without an account (proof of work included) and returns a sandbox client: three endpoints for 24 hours, kept in the agent credential file and reused on the next run
  • •`sandbox.claim(email)` and `sandbox.wait_for_claim()` connect it to a human's account, and `WebhooksCC.connect(email)` does so without a sandbox; the connection is saved, `WebhooksCC.connected()` returns it, and `WebhooksCC()` without a key uses it
  • •`webhooks_cc.agent` has each auth.md step on its own, and `webhooks_cc.credentials` reads and writes the credential file
Go SDKv0.3.0

The Agent Sandbox

  • •`NewSandbox` registers an agent without an account (proof of work included) and returns a sandbox: three endpoints for 24 hours, kept in the agent credential file and reused on the next run
  • •`Sandbox.Claim` and `WaitForClaim` connect it to a human's account, and `Connect` does so without a sandbox; the connection is saved, `Connected` returns it, and `New()` without a key uses it
  • •The `agent` package has each auth.md step on its own
MCPv1.15.0

Connections That Survive Restarts

  • •The sandbox and the account connection are saved in the agent credential file (~/.config/whk/agent.json), so a new session starts connected, with the full tools, and the human approves the agent once; when they disconnect it, the sandbox tools come back
  • •`npx @webhooks-cc/mcp setup <tool>` works without an API key, and the VS Code and Codex configs it writes use their current formats
  • •The same tools run on the remote server at https://webhooks.cc/mcp (tools that post to a URL you name stay local)
Web Appv0.47.0

A Clean Style of Its Own, One Header

  • •Clean is now the style everyone gets; the classic neobrutalist look, and light or dark mode, are chosen under Account > Appearance instead of from the nav bar, and the choice stays with the browser
  • •One header for every page, anchored at the top, in place of the floating bar on the docs, blog and provider pages and the fixed one everywhere else; the docs sidebar is a plain column beside the content
  • •The clean style is no longer stock shadcn: pages sit on a cool paper canvas with white surfaces and hairlines instead of shadows, buttons, links and selected tabs share one pine green drawn from the brand mint, and the text is set in IBM Plex Sans with IBM Plex Mono for URLs, headers and bodies
  • •Dark mode in the clean style follows the same system, with the mint as the accent and surfaces that step up from the canvas instead of fading into it
  • •Scrollbars take the style's own colours in both modes, a thin grey in clean and a solid bar in classic, instead of the browser's white ones
  • •The docs sidebar opens only the section you are in; the others start folded, and one you open stays open until you move to another page
Web Appv0.46.0

Extra Requests: Monthly Blocks, One-Time Blocks and Overage

  • •Pro accounts and team pools can go past the plan's requests in blocks of 25,000: monthly blocks ($2, renewed with the plan), one-time blocks ($3, kept until used) and overage ($4 per 25,000, billed at the end of the period, up to a maximum you set). They are used in that order once the plan's requests run out, so webhooks keep arriving instead of meeting a 429
  • •Monthly blocks added mid-period count at once for the full monthly price and renew with the plan; fewer blocks take effect at the renewal. Cancelling the plan ends its monthly blocks and overage with it, and keeping the plan brings them back
  • •The usage API counts monthly blocks in its limit and reports one-time blocks and overage, and its remaining figure is what the receiver will still accept this period
Web Appv0.45.2

Quieter Browser Error Reports

  • •Error reports from the browser leave out the error Microsoft's link scanners raise in their own browser when they open a link to webhooks.cc, so it no longer shows up as a crash of ours
Web Appv0.45.1

Better Linked Guides and Fewer Overlapping Pages

  • •Blog posts suggest posts on the same topics instead of always the two newest, and every provider page links its neighbours in the category, so no page is left linked from a hub alone
  • •The CI/CD and Stripe guides take in the blog posts that covered the same ground (matchers, payload diffs, the flow builder, tunnelling live Stripe events); the old post URLs and the three docs comparison guides redirect to the pages that replaced them
  • •A full Playwright E2E guide, Razorpay events and FAQs, and clearer titles for the SDK testing, tunnel and mock response docs
Web Appv0.45.0

Fields Picked Out of Emails, Reply Text, and Mail Provider Shapes

  • •Name a value and say where it is (the subject, the text, the HTML, the sender, the recipients or a header, with an RE2 pattern), and every email shows it, carries it in its JSON as fields, and hands it to forwarding: templates read {{ fields.invoice }} and a filter can check it. Each field shows what it finds in the newest email as you type
  • •Replies carry replyText, what the sender wrote above the quoted message without their signature, and the Text tab has Reply only
  • •A destination can post emails the way Postmark, SendGrid Inbound Parse, a Mailgun route or CloudMailin posts them, a Mailgun form signed with your own signing key, so the inbound handler you already wrote runs against real mail; the Inbound email handler preset starts one
  • •The API renders an email in any of those shapes (POST /api/requests/{id}/render), and returns your fields and the reply text with extracts=true
Web Appv0.44.0

Forwarding to Several Destinations, Filtered and Shaped

  • •Forwarding sends to up to 10 destinations per endpoint: your servers, Slack or Discord channels, and tools like Zapier or n8n. Each has its own kinds, format, headers, retries, signing secret and last 24 hours, and adding one starts from what it is for
  • •Conditions decide what a destination gets, in the same language as response rules plus the kind, an email's subject, sender, recipients, text or tag, its spam score, the SPF, DKIM and DMARC results, and the signature check; what they turn down is logged as Filtered out, and Send anyway delivers it once
  • •Your JSON: write the body a destination sends, with placeholders filled in from each request or email, so only the fields you pick go out, under the names your tool wants; a lone placeholder keeps its type. Chat destinations can have their own message text
  • •At most one every so many seconds turns a destination into a heads-up channel, and Wait before sending (up to an hour) makes it a callback that arrives later
  • •Preview with a captured request shows whether a destination would send it and the exact request, before you save; Send test delivery sends one for real
  • •Notifications are a Slack or Discord destination now: the same message at most once a second, listed under Forwarding and logged like any other delivery. Existing notification URLs moved over as they were
  • •The Deliveries log names each delivery's destination and filters by destination and by Filtered out; a request's Deliveries tab groups the tries by destination, with Redeliver for each
  • •The API, SDK and MCP server manage destinations too: /api/endpoints/{slug}/destinations, client.destinations, and add_destination, preview_destination and three more tools
  • •A destination can no longer be a webhooks.cc capture URL, so a delivery can never be captured and forwarded again in a loop
Web Appv0.43.0

Responses That Read More and Echo the Request

  • •Settings has one Responses list in the order the receiver checks it: numbered rules from the top, the first that matches answers, and Otherwise for the rest; every answer has a status, a delay, a body and now headers
  • •Rule conditions read more and compare more ways: is not, does not contain, ends with, matches regex (RE2, so a pattern can never slow an endpoint down), is missing, and is more or less than for numbers; a body field can be read from form bodies too, and conditions can check the content type and the body's size
  • •Bodies and header values take placeholders filled in from each request, such as {{ json.id }}, {{ headers.user-agent }}, {{ query.page }}, {{ uuid }} and {{ now }}, with filters like | default and | upper; in a JSON body, text is escaped so the answer stays valid JSON. Insert field picks one for you
  • •Preview with a captured request shows which rule answers and exactly what it sends, and marks that rule in the list; the API has it too (POST /api/endpoints/{slug}/responses/preview)
CLIv1.5.0

Emails Through the Tunnel

  • •whk tunnel delivers captured emails to your machine again, now as webhooks.cc's email.received JSON (the body forwarding posts, unsigned here) instead of a raw message; this replaces 1.3.2's "emails are not tunneled"
  • •--email-format postmark, sendgrid, mailgun or cloudmailin posts each email the way that service's inbound webhook does, so the handler you wrote for it runs against real mail; --mailgun-signing-key (or WHK_MAILGUN_SIGNING_KEY) signs a Mailgun form with your key
  • •--email-path sends emails to a path of their own on the target, and --no-email skips them
  • •Emails show their recipient and subject in the tunnel's output, the JSON events and the request lists, with encoded subjects decoded
SDKv1.18.0

Destinations, Response Rules and Email Fields

  • •`client.destinations`: list, get, create, update, delete, reorder, secret, rotateSecret, test and preview an endpoint's forwarding destinations, each with its own kinds, filter, format (as received, signed JSON, your own JSON template, a chat message, or a mail provider's shape), throttle and delay. `forwarding.redeliver()`, `redeliverFailed()` and `deliveries()` take a `destinationId`, and the log has a `skipped` status for what a filter turned down
  • •`verifyForwardedJson()` checks a delivery of a destination's own JSON and returns its body
  • •`endpoints.previewResponse()` runs response rules and a mock response with its {{ placeholders }} against a captured request; conditions gain operators (is not, ends with, RE2 regex, number comparisons, is missing) and fields (body, content type, size), and `evaluateConditions()` and `renderTemplate()` are exported
  • •Emails: `emails.get()` returns the endpoint's named fields as `emailFields` and the reply text as `replyText`, `buildEmailJson()` and `emails.toJson()` add `replyText` and `fields`, `emails.toInbound()` builds an email in Postmark, SendGrid, Mailgun or CloudMailin shape locally and `emails.render()` asks webhooks.cc for it. Endpoints take `emailFields`, and filters an `email_field` condition
  • •`matchPath()` reads `?` as exactly one character, as the receiver always did
  • •Conformance vectors: `rules.json` and `placeholders.json` are new, and `forwarding.json` is at format 3 with `verifyForwardedJson`
Python SDKv0.2.0

Destinations, Response Previews and Email Fields

  • •`client.destinations` manages an endpoint's forwarding destinations, and `verify_forwarded_json()` checks a delivery of a destination's own JSON
  • •`client.endpoints.preview_response()` runs response rules and placeholders against a captured request
  • •Email requests carry the endpoint's named fields (`email_fields`) and the reply text (`reply_text`); endpoints take `email_fields`; `client.emails.render()` returns an email in Postmark, SendGrid, Mailgun or CloudMailin shape to post to your inbound handler
  • •`match_path()` reads `?` as exactly one character, as the receiver does
Go SDKv0.2.0

Destinations, Response Previews and Email Fields

  • •`client.Destinations` manages an endpoint's forwarding destinations, and `verify.ForwardedJSON` checks a delivery of a destination's own JSON
  • •`client.Endpoints.PreviewResponse` runs response rules and placeholders against a captured request
  • •Email requests carry the endpoint's named fields and the reply text; endpoints take `EmailFields`; `client.Emails.Render` returns an email in Postmark, SendGrid, Mailgun or CloudMailin shape to post to your inbound handler
  • •`MatchPath` reads `?` as exactly one character, as the receiver does
MCPv1.14.0

Destinations, Response Previews and Email Fields

  • •New tools `list_destinations`, `add_destination`, `update_destination`, `remove_destination` and `preview_destination` manage an endpoint's forwarding destinations, with filters, your own JSON, chat messages, mail provider shapes, throttles and delays; `get_forwarding_secret`, `test_forwarding`, `list_deliveries` and `redeliver` take a `destinationId`
  • •`preview_response` dry-runs response rules and placeholders, and conditions are checked with the SDK's rule language before they are sent
  • •`render_email` gives a captured email in Postmark, SendGrid, Mailgun or CloudMailin shape and can post it to your local inbound handler; `update_endpoint` takes `emailFields`, and `get_email` returns them as `fields` with the `replyText`
  • •46 tools
Web Appv0.42.4

Which Calls the SDKs Retry

  • •The TypeScript, Python and Go SDK pages say which calls a retry repeats: GET, PUT and DELETE after a network error, a timeout or a retryable status (429, 500, 502, 503 and 504 by default), and any call after a 429
Web Appv0.42.3

Go SDK Docs

  • •A Go SDK page in the docs: install, waiting for webhooks, testing helpers, codes and links from test email, signed webhooks for your handler, and signature verification
  • •`go get webhooks.cc/go` resolves: webhooks.cc tells the go command where the module lives
  • •The changelog has a Go SDK track
SDKv1.17.1

Safer Retries and Waits

  • •With `retry` on, a POST or PATCH (`endpoints.create()`, `emails.sendTest()`, ...) is repeated only after a 429. After a network error, a timeout or a 5xx it may have gone through, and a repeated `endpoints.create()` left an extra endpoint behind. GET, PUT and DELETE are repeated as before, except `requests.clear()` without `before`, whose repeat would also delete what arrived in between
  • •`waitFor()` and `waitForAll()` poll from 30 seconds before the newest request they have seen, by the server's clock, instead of from the local time of the last poll, which skipped requests when this machine's clock ran ahead of the server's. A poll that times out no longer ends the wait; the next one tries again
  • •A Standard Webhooks, Clerk, Resend or forwarding secret that decodes to no key at all (`whsec_` alone, or whitespace) throws before the headers are read, in `verifySignature()`, `verifyStandardWebhookSignature()` and the forwarding checks. Before, a request without signature headers got `false` or `missing_headers` instead
Python SDKv0.1.3

Safer Retries and Waits, Text Read as JavaScript Reads It

  • •With `retry` on, a POST or PATCH (`endpoints.create()`, `emails.send_test()`, ...) is repeated only after a 429. After a network error, a timeout or a 5xx it may have gone through, and a repeated `endpoints.create()` left an extra endpoint behind. GET, PUT and DELETE are repeated as before, except `requests.clear()` without `before`, whose repeat would also delete what arrived in between
  • •`wait_for()` and `wait_for_all()` poll from 30 seconds before the newest request they have seen, by the server's clock, instead of from the local time of the last poll, which skipped requests when this machine's clock ran ahead of the server's. A poll that times out no longer ends the wait; the next one tries again
  • •Body matchers treat a body with `NaN` or `Infinity` as not JSON, as `JSON.parse` does
  • •Signature headers, content types, durations and `Retry-After` are trimmed of JavaScript's whitespace rather than Python's, and only ASCII digits count as digits, as in the TypeScript SDK; timestamp filters read numbers as JavaScript's `Number()` does
  • •Mailgun and Adyen bodies, which are signed after being written out again, put keys that are array indexes (`"0"`, `"12"`) first, as `JSON.stringify` does
  • •A PayPal certificate URL reads a backslash as a slash only before its query, as browsers do
Python SDKv0.1.2

Empty Signing Keys Are Refused

  • •A Standard Webhooks, Clerk, Resend or forwarding secret that decodes to no key at all (`whsec_` alone, or whitespace) now raises `ValueError` in `verify_signature()`, the forwarding checks and request building. Before, such a secret accepted any signature made with an empty key, which anyone can compute
Go SDKv0.1.1

Safer Retries

  • •With `WithRetry`, a POST or PATCH (`Endpoints.Create`, `Emails.SendTest`, ...) is repeated only after a 429. After a dropped connection, a timeout or a 5xx it may have gone through, and a repeated `Endpoints.Create` left an extra endpoint behind. GET, PUT and DELETE are repeated as before, except `Requests.Clear` without `Before`, whose repeat would also delete what arrived in between
  • •A poll that times out no longer ends `WaitFor` or `WaitForAll`; the next one tries again
  • •`verify.ErrEmptyKey` is exported, so `errors.Is` tells a secret that decodes to no key at all from a failed check
  • •Content types, hex keys, `Retry-After` and PayPal certificates are trimmed of JavaScript's whitespace, as the TypeScript SDK trims them, rather than of the set `strings.TrimSpace` takes
Go SDKv0.1.0

The Go SDK

  • •`go get webhooks.cc/go`: a client for endpoints, captured requests and test email, with `WaitFor`, `WaitForAll` and a live `Subscribe` stream you range over, which follows the server's connection rotation
  • •`SendTo` and `BuildRequest` sign webhooks for your own handler the way 34 providers sign theirs, with their sample payloads
  • •The `verify` package checks 32 providers' signatures, and `ForwardedEmail`, `ForwardedRequest` and `RelayedRequest` check what webhooks.cc forwards, with no client or API key needed
  • •Matchers, `ExtractCode` and `ExtractLink` for test email, `CaptureDuring` and `CaptureEmailDuring`, and the `whktest` helpers for `testing.TB`
  • •Standard library only, `context.Context` and `time.Duration` throughout, and the same conformance tests as the TypeScript SDK for signing, verification and matchers
Web Appv0.42.2

Python SDK 0.1.1 Docs

  • •The Python SDK page says signed requests never follow redirects, now that 0.1.1 refuses them with your own HTTP client too
Web Appv0.42.1

Python SDK Docs

  • •A Python SDK page in the docs: install, waiting for webhooks, pytest fixtures, codes and links from test email, signed webhooks for your handler, and signature verification
  • •The changelog has a Python SDK track
Web Appv0.42.0

Share Links

  • •Share a captured request as a read-only link for a pull request, ticket or chat; anyone with the link sees it in the same inspector, Schema view included, without an account
  • •Authorization and cookie headers are always hidden, signatures, tokens and keys by default, and the dialog shows what will be hidden before you create the link
  • •Links last 1, 7 or 30 days and keep working after the request itself is deleted; revoke one from the request's Share dialog or from Account, Share links, which lists every live link (migration 00062)
  • •Only an endpoint's owner can share its requests, and share links take a signed-in session, never an API key
Web Appv0.41.0

Payload Schemas, Provider Test Files, and an Agent Skill

  • •A Schema view next to Tree and Formatted turns a request body into TypeScript interfaces, Zod schemas, Pydantic models or JSON Schema, learned from every recent request of the same event so optional and nullable fields come out right
  • •Provider pages for the 30 providers whose test payloads a real handler can verify show a ready-to-run Vitest file that sends signed samples to your local handler and checks it rejects forged ones
  • •A webhook testing skill for coding agents, as a Claude Code plugin with the MCP server (/plugin install webhooks-cc --marketplace kroqdotdev/webhooks-cc) and for Cursor, Codex and Copilot through npx skills add; docs at /docs/mcp/skills
Web Appv0.40.8

Clean Support Link in the Password Email

  • •The templates GoTrue fetches for sign-up, reset and password-changed emails are served with Cache-Control: no-transform, so Cloudflare no longer swaps the support address in them for an obfuscated placeholder
Web Appv0.40.7

Password Change Emails and Audit Trail

  • •Changing or resetting your password now sends an email to your account from noreply@webhooks.cc, so a change you didn't make doesn't go unnoticed
  • •Every password change is recorded in the account's audit trail, whichever way it was made (migration 00061)
Web Appv0.40.6

Email Codes and Links in the API

  • •Add extracts=true to the request list, the paginated list or a single request, and each email carries extracts: the one-time codes and links found in it, the same ones the dashboard shows
  • •A test in any language can read the code or confirm link from the response without parsing the message; extracts is null when the endpoint's Show codes and links found in emails is off
  • •Code detection keeps at most 20 codes per email, so an email stuffed with numbers stays fast to read in the dashboard, forwarding and the API
Web Appv0.40.5

Change Your Password from the Profile Page

  • •Accounts that sign in with email and password can change it on the Profile page; it asks for the current password, and the change signs you out on every other browser and device
  • •Forgot the current one, or never set one? The same panel emails you a reset link
SDKv1.17.0

Payload Schemas from Captured Requests

  • •`generateRequestSchema()` writes TypeScript interfaces, Zod schemas, Pydantic models or JSON Schema from captured requests; several requests of one event mark fields missing from some as optional and sometimes-null ones as nullable
  • •`generatePayloadSchema()` does the same from parsed values, and `payloadSample()` returns the value a request contributes (JSON, or form fields as strings)
  • •The new `@webhooks-cc/sdk/schema` entry point exports them without the client, for browser bundles
SDKv1.16.0

Repeatable Standard Webhooks, Clerk and Resend Signatures

  • •`sendTo()`, `buildRequest()` and `sendTemplate()` take `messageId` for the providers that sign one (`standard-webhooks`, `clerk`, `resend`); with `timestamp`, the signature comes out the same on every run
  • •Timeouts and poll intervals given as strings read a bare number only as decimal milliseconds, so `"0x10"` or `"1e3"` is refused instead of quietly read as 16 or 1000
  • •`extractFromEmail()` returns at most 20 codes, and finding them stays fast on an email stuffed with numbers
Python SDKv0.1.1

Signed Requests Never Follow Redirects

  • •`send_to()`, `endpoints.send()`, `send_template()` and `requests.replay()` refuse redirects even when the `http_client` you pass follows them, so a signed request only reaches the host you named
Python SDKv0.1.0

The Python SDK

  • •`pip install webhooks-cc`: a client for endpoints, captured requests and test email, with `wait_for`, `wait_for_all` and a live `subscribe` stream that follows the server's connection rotation
  • •`send_to()` and `build_request()` sign webhooks for your own handler the way 34 providers sign theirs, with their sample payloads
  • •`verify_signature()` checks 32 providers' signatures, and `verify_forwarded_email()`, `verify_forwarded_request()` and `verify_relayed_request()` check what webhooks.cc forwards (Discord and PayPal need the `crypto` extra)
  • •Matchers, `extract_code()` and `extract_link()` for test email, `temporary_endpoint`, `capture_during` and `capture_email_during`
  • •pytest fixtures `webhooks_cc` and `webhooks_cc_endpoint`, skipped when `WHK_API_KEY` is not set
  • •Passes the same conformance tests as the TypeScript SDK for signing, verification, matchers and durations
MCPv1.13.0

Payload Schemas and the MCP Registry

  • •New `generate_payload_schema` tool, with an API key and in the sandbox: TypeScript, Zod, Pydantic or JSON Schema from captured bodies, filtered by event, method, path or request ids, with a warning when the samples mix events
  • •Published to the official MCP Registry as `io.github.kroqdotdev/webhooks-cc` with each release
  • •The `setup_provider_testing` prompt ends with generating the payload types
Web Appv0.40.4

Rejected Webhook Counts in Quota Alerts

  • •The quota-exhausted email and the dashboard quota banner now say how many webhooks were rejected this period and on which endpoints, most rejected first, with the rest summarized as a count
  • •Rejections on endpoints billed to a subscribed team are left out, matching the existing note that those endpoints keep capturing
  • •New get_quota_rejections() database function (migration 00060) reads the per-endpoint counts from endpoint_daily_stats; /api/usage returns them as quotaRejections while the quota is exhausted
Web Appv0.40.3

Sitemap Last-Modified Header and Deterministic PoW Unit Test

  • •Serve /sitemap.xml from an explicit route handler with a Last-Modified HTTP response header set to the newest entry timestamp
  • •Make the proof-of-work insufficient-work unit test deterministic across random challenges
Web Appv0.40.2

Svix and Stripe CLI Comparisons, 10 Provider Reference Tables, and Search Hygiene

  • •New side-by-side comparison pages for Svix (/compare/svix) and Stripe CLI (/compare/stripe-cli), plus updated ngrok and comparison hub checklists
  • •Event and signature reference tables and FAQs on the Linear, DocuSign, SendGrid, Paddle, Intercom, Square, Cal.com, Coinbase Commerce, Adyen, and Checkout.com webhook pages
  • •Clarified SDK verifySignature() reference vs the signature verification guide, canonicalized the comparison guide to /compare, and expanded MCP server registry and client documentation
  • •Permanent redirects for /webhooks/amazon-sns and legacy comparison URLs, plus explicit X-Robots-Tag noindex headers on private routes
Web Appv0.40.1

Refuse Server Action Probes at the Edge

  • •POST requests to page routes and requests carrying a Next-Action header now receive a plain 404 from the proxy before reaching Next's Server Action handler
Web Appv0.40.0

Rebuilt Account and Team Settings

  • •Account and team settings share one layout with a side nav: Profile, Plan and usage, API keys, Connected agents, and each of your teams
  • •Set the display name your teammates see; signing in again with GitHub or Google no longer overwrites it
  • •A team's page shows its seats as a rail, one block per seat, filled with the pooled usage and labelled with who holds each seat
  • •Owners can cancel a pending invite, and every member sees all endpoints shared with the team and who shared them
  • •API keys show when they were last used and when they expire; removing a member or leaving a team now asks first
Web Appv0.39.5

Sturdier Not-Found Page

  • •A stray form POST that Next answers with its own 404 page no longer fails with a server error
Web Appv0.39.4

Teams Page and Clearer Comparisons

  • •A public Teams page at /for-teams: what teams use shared endpoints for, the feature checklist, who can do what, and pricing examples; the site banner, the landing page and the Teams docs link to it
  • •The comparison hub puts all eight tools in one feature checklist and answers the questions people ask when choosing one
  • •The ngrok and Hookdeck comparisons are up to date: ngrok's local inspector replays requests, and Hookdeck now has an MCP server
  • •The Lemon Squeezy page lists the test-mode card numbers, the Mux page the common events, and the Clerk and Discord pages answer how to verify, retry and check webhooks
Web Appv0.39.3

Source Map Upload Check

  • •The release build uses StatOSS CLI 0.2.1 and trusts its exit status again, so the deploy log warns only when browser source maps really failed to upload
Web Appv0.39.2

Browser Error Reports

  • •When a page fails in the browser, the error goes to StatOSS with the page address (without its query) and the browser, so we see crashes you would otherwise have to tell us about
  • •Reports leave out email addresses, query strings, and errors that are not ours: browser extensions, dropped connections, and tabs left open across a release
Web Appv0.39.1

Error Monitoring on StatOSS

  • •Server errors and logs from the web app, the webhook receiver and the mail server go to StatOSS, our own monitoring service, instead of AppSignal
  • •A failure that repeats for every request is reported once a minute, so an outage reaches us as one alert with a count
  • •The privacy policy and the list of subprocessors say where error reports and logs are kept
Web Appv0.39.0

Spam Scores for Captured Email

  • •Emails are scored by rspamd as they arrive: the header shows Not spam, Looks spammy or Spam with the score, and the Authentication tab shows the threshold, what rspamd would suggest, and the rules that weighed most
  • •The score is only information: every email that reaches an address is still captured, so you can see why your own mail looks like spam before you ship it
  • •Forwarded email JSON carries `data.spam` with the score, threshold and suggested action
Web Appv0.38.2

Forwarding Setup Fixes

  • •Setting up forwarding proposes both HTTP requests and emails, so pasting a Slack or server URL forwards webhooks without an extra tick
  • •The forwarding switch's help no longer suggests a test delivery is required before turning it on
  • •Coming back to the dashboard shows the request list loading instead of briefly saying the endpoint is waiting for its first request
Web Appv0.38.1

Forwarding Docs for the SDK and MCP

  • •The SDK and MCP docs cover every forwarding setting, the delivery log, redelivering everything that failed, and verifying forwarded HTTP requests
Web Appv0.38.0

Forward Webhooks, Not Only Emails

  • •Forwarding sends an endpoint's HTTP requests on too, not only its emails: relayed as received (same method, headers and body bytes, so the provider's signature still verifies on your server), as signed JSON, or as a chat message when the URL is a Slack or Discord webhook
  • •Relayed requests keep the path after the slug and the query string, and carry `webhooks-cc-received-at`, `webhooks-cc-request-id`, `webhooks-cc-endpoint`, `webhooks-cc-attempt` and `webhooks-cc-signature`
  • •Add up to 10 headers of your own to every delivery, such as the token your server expects; values are stored encrypted
  • •Advanced options: append the request path or not, retry for a day, an hour or not at all, and keep capture order by delivering one request at a time
  • •Timing for every delivery: when the sender sent it (from a JSON field you name, such as publishedAt, or a timestamp header), when webhooks.cc received it, and when your server took it, to the millisecond; chat messages say how long after the sender's time each request arrived
  • •A delivery log in Settings with Retrying and Failed filters, the last 24 hours at a glance, and Redeliver all failed
  • •HTTP requests get a Deliveries tab like emails, with Redeliver
  • •Messages to Slack and Discord are spaced to their rate limits, and a 429 is retried after the time it asks for
SDKv1.15.0

Spam Scores on Emails

  • •`EmailCapture.spam` carries rspamd's verdict: `score`, `required`, `action`, the rules that weighed most (`symbols`) and `error` when there is no score
  • •`buildEmailJson()` and `emails.toJson()` add `data.spam` with the score, threshold and suggested action, as forwarding posts it
SDKv1.14.0

Forwarding for HTTP Requests

  • •`forwarding.configure()` takes every setting: `http`, `email`, `format`, your own `headers`, `appendPath`, `retrySeconds`, `keepOrder` and `sentField` (the sender's timestamp in the body)
  • •`forwarding.deliveries()` filters by `status` and pages with `before`, and its rows carry the format, the request's method and path, and the sender's timestamp
  • •`forwarding.summary()`, `forwarding.redeliverFailed()` and `forwarding.requestDeliveries()`, which covers HTTP requests too (`emailDeliveries()` stays as its old name)
  • •`forwarding.test()` takes a `kind` and reports the format, target and sender's timestamp it used
  • •`verifyRelayedRequest()` checks the `webhooks-cc-signature` on a request relayed as received, and `verifyForwardedRequest()` a `request.received` event sent as signed JSON
MCPv1.12.1

Spam Scores on Emails

  • •`get_email` and the request tools include an email's spam score; when an email has to shrink to fit, the rules go first and the score stays
MCPv1.12.0

Forwarding for HTTP Requests

  • •`configure_forwarding` takes every setting: which kinds, the format, your own headers, path, retries, order and the sent time field
  • •`list_deliveries` returns an endpoint's log with its counts, filters by status and pages with a cursor; rows carry the sender's timestamp for timing
  • •`test_forwarding` takes a `kind`
  • •`redeliver` replaces `redeliver_email`: it sends one request or email again, or every failed delivery of an endpoint
Web Appv0.37.4

Notifications Show the Whole Payload and When It Arrived

  • •Slack and Discord notifications show up to 3,000 characters of the body instead of the 200-character preview; Discord messages are cut inside the code block, so it always closes
  • •Every notification message says when the request arrived (UTC, to the millisecond), and `receivedAt` in the JSON uses the same format, so you can measure how long a webhook took to reach webhooks.cc
Web Appv0.37.3

MCP Sandbox Docs

  • •The MCP docs describe the sandbox tools a server gets without an API key, and how an agent connects to your account from there
Web Appv0.37.2

Identity-Provider Sign-In for Agents, Hardened

  • •An agent signing in through a trusted identity provider (ID-JAG) is never linked to an existing account silently: the account's owner confirms it with a code on the same page used to connect any agent, which names the provider
  • •ID-JAG sign-ins need a recent `auth_time` (one hour by default) and otherwise answer `login_required`, as auth.md v0.5 requires
  • •Identity providers can revoke an agent's link with a Security Event Token at /api/agent/event/notify, now listed in the discovery document
  • •No identity provider is trusted on webhooks.cc yet; this readies the flow for the first one
Web Appv0.37.1

SDK Sandbox Docs

  • •The SDK reference covers `WebhooksCC.sandbox()`, connecting an agent to an account from code, and the auth.md steps in `WebhooksCC.agent`
Web Appv0.37.0

Connect an Agent to Your Account

  • •An AI agent can be connected to your account: it shows you a link and a 6-digit code, you sign in and enter the code, and its sandbox endpoints move into your account with what they captured
  • •Agents that only know your email can register for you (auth.md service_auth); nothing works until you connect them, and no email is sent to you to start it
  • •Account has a Connected Agents list with one-click disconnect, and you get an email whenever an agent is connected
  • •The older email-code registration for agents is deprecated and stops on November 30, 2026
Web Appv0.36.1

Notifications That Slack and Discord Can Show

  • •Notification webhooks now carry a ready-made message (`text` for Slack, `content` for Discord), so Slack incoming webhooks post them instead of rejecting them, and plain Discord webhook URLs work without the /slack suffix
  • •Text from the incoming request is escaped for Slack, long paths are shortened, and Discord notifications cannot ping @everyone
  • •Emails are announced as emails, and a notification URL that answers with an error is now recorded on our side
  • •The notification docs no longer claim Slack shows the raw JSON, and explain Microsoft Teams after the retirement of Office 365 connectors
Web Appv0.36.0

Agent Sandbox on auth.md v0.6

  • •AI agents register through auth.md v0.6: a short proof of work, then a signed identity assertion they exchange for one-hour access tokens at /api/oauth2/token
  • •An agent without an account gets a 24-hour sandbox: 3 endpoints, 25 captured requests each and 100 in all, readable only with its own token
  • •/auth.md, the discovery documents and a new AI Agents docs page describe the flow; the claim ceremony that connects an agent to your account follows in the next release
  • •Anonymous and ID-JAG registration on the old auth.md v0.1 endpoints answer 410 with a pointer to /auth.md; email verification keeps working for older SDK and MCP versions
SDKv1.13.0

Agent Sandbox

  • •`WebhooksCC.sandbox()` captures webhooks without an API key: it registers through auth.md v0.6, solves the proof of work (about 3 seconds) and returns a client for up to 3 endpoints, 25 requests each and 100 in all, for 24 hours
  • •`sandbox.claim({ email })` and `sandbox.waitForClaim()` connect the agent to a human's account and return a `WebhooksCC` for it, whose token renews itself
  • •`WebhooksCC.agent.*` exposes each auth.md step: discover, challenge, solveChallenge, registerAnonymous, registerServiceAuth, exchange, startClaim, pollClaim, waitForClaim and revoke
  • •A dependency-free proof-of-work solver for Node and browsers that yields to the event loop and refuses more than 2^26 hashes
  • •`new WebhooksCC({ getAccessToken })` accepts an expiring token instead of an API key and renews it once after a 401
  • •`WebhooksCC.register.*` is deprecated: the server answers its anonymous and ID-JAG flows with 410 (`AgentRegisterError` code `endpoint_moved`), and its email flow stops on November 30, 2026
MCPv1.11.0

Agent Sandbox Without an API Key

  • •Without `WHK_API_KEY` the server works at once: `create_endpoint`, `list_endpoints`, `get_endpoint`, `delete_endpoint`, `list_requests`, `get_request` and `wait_for_request` run in the agent sandbox (3 endpoints, 25 requests each and 100 in all, for 24 hours), registered on first use through auth.md v0.6
  • •`connect_account` gives the agent a link and a 6-digit code for you; after you enter it, `wait_for_connection` swaps in the full tools for your account, sandbox endpoints included
  • •`about_sandbox` explains the limits and the connection without a network call
  • •The auth.md v0.1 registration tools (`how_to_register`, `register_agent`, `check_claim`, `register_agent_with_email`, `verify_agent_otp`, `register_agent_with_idjag`) are gone: the server answers the anonymous and ID-JAG ones with 410 since the move to auth.md v0.6, and its emailed-code flow stops on November 30, 2026; `connect_account` replaces it
Web Appv0.35.6

Agent Registration Fixes

  • •An anonymous agent key's response and /auth.md now say when it expires: with its claim, 15 minutes after registration, unless a human claims it
  • •Agent sandbox endpoints have their own capacity pool and can no longer be read or claimed through the guest routes
  • •Agent registrations, claims and sandbox endpoints are recorded in the audit trail
MCPv1.10.1

Agent Registration Wording

  • •`how_to_register` and `register_agent` describe the claim step correctly and say that an unclaimed key only works with the sandbox and expires about 15 minutes after registration
Web Appv0.35.5

Claimed Endpoints Keep Their Requests

  • •Requests a guest endpoint received before you signed in and kept it now belong to your account: search finds them, and they follow your plan's retention
Web Appv0.35.4

No Accounts at mailhooks.cc

  • •New accounts can no longer use an address at mailhooks.cc, by email and password or through GitHub or Google: mail there can be read through webhooks.cc itself, so it proves nothing about who signs up
  • •The sign-up form says so right away instead of showing a generic error
Web Appv0.35.3

Agent Registration and Rate Limit Fixes

  • •Agents can no longer register with an address at mailhooks.cc: its codes can be read through webhooks.cc itself, so it proved nothing
  • •Each rate limit now counts on its own: a one-minute limit no longer erased the history of an hourly one from the same IP, which let agent registration run far above its hourly limit
  • •IPv6 clients are rate-limited per /64, so a fresh address per request no longer gets a fresh limit
Web Appv0.35.2

MCP Email Docs

  • •The MCP tools reference and workflows cover the email and forwarding tools, with a signup-email walkthrough
  • •New guide: testing signup and login emails in Playwright
  • •The CLI reference covers whk get and whk requests, including how emails are shown
Web Appv0.35.1

Landing Counters After Deploys

  • •The developer, endpoint and webhook counters on the landing page no longer disappear for the first minutes after a release
Web Appv0.35.0

Emails in the API and SDK

  • •The request list API takes kind=email or kind=http, and live stream events say which kind each request is
  • •Send test email takes an optional tag, so a test can wait for its own sample
  • •The dashboard, forwarding and the SDK now share one code and link finder and one email JSON builder, from the SDK
  • •SDK docs for emails and forwarding; the email testing and email-to-webhook pages show the SDK
Web Appv0.34.2

Faster Code and Link Finder

  • •Finding one-time codes and links in an email, and counting its images for the preview, take time in proportion to its size; certain malformed emails could make them take minutes, in the dashboard and when forwarding
Web Appv0.34.1

Email Pages and API Reference

  • •New pages on email testing and on turning inbound email into a webhook, linked from the home page
  • •The REST API reference and the OpenAPI spec cover emails, the forwarding settings, the signing secret, test deliveries and the delivery log
  • •The Webhook.site comparison covers email capture and forwarding, and the dashboard docs list the Forwarding section of Settings
  • •Pro requests stay visible for all 31 days they are kept; the dashboard and API stopped showing them after 30
  • •Only an endpoint's owner can turn off "Show codes and links found in emails", because it also decides whether forwarded emails carry their codes and links
Web Appv0.34.0

Email as JSON, Forwarded to Your Server

  • •Every email now opens on a JSON tab: the parsed email (sender, recipients, subject, text, HTML, the codes and links found in it, attachments and sender checks) as JSON, ready to copy as a test fixture
  • •Forwarding: turn it on in an endpoint's Settings and every email it receives is POSTed to your URL as that JSON, signed with Standard Webhooks headers, so your app can handle inbound email without a mail server
  • •Deliveries that fail are tried again after 30 s, 2 min, 10 min, 30 min, 1 h, 3 h, 6 h and 12 h. Each email's Deliveries tab shows every try with your server's answer, and Redeliver sends it again
  • •Settings shows the signing secret (reveal, copy, rotate), sends a test delivery and lists the latest deliveries
CLIv1.4.1

TLS Library Update

  • •rustls 0.23.45
CLIv1.4.0

Emails in the Terminal

  • •whk requests list shows a captured email's subject next to the address it arrived at, and EMAIL gets its own colour
  • •whk requests get on an email shows the sender, recipient, subject, tag, attachments and text part instead of the raw message; --json still has every header and the raw message
  • •whk create and whk get print the endpoint's mailhooks.cc email address
  • •An email's subject, sender and attachment names stay on one line, so a sender cannot fake rows in the list
  • •whk get no longer shows a request count of 0 when the API sends none
CLIv1.3.2

Emails Stay Out of the Tunnel

  • •whk tunnel no longer passes captured emails to your local server and lists them as not tunneled instead: an email is a raw message sent to an address, not an HTTP request. To receive emails in your app, use forwarding (webhooks.cc/docs/forwarding)
  • •Fixed: with a port-only target such as whk tunnel 8080, an email's recipient address was read as part of the host name, so the message went over plain HTTP to mailhooks.cc, which only redirects, instead of to your machine. Update if you tunnel an endpoint that receives email
  • •A captured path without a leading slash can no longer change the host the tunnel or whk replay sends to
  • •whk replay refuses emails and points to forwarding
SDKv1.12.0

Emails and Forwarding

  • •`client.emails` for the email every endpoint receives at mailhooks.cc: `address()` (with a `+tag` per test run), `list()`, `get()`, `latest()`, `waitFor()`, `waitForAll()`, `sendTest()` and `toJson()`
  • •`extractCode()`, `extractLink()` and `extractFromEmail()`: the dashboard's one-time code and link finder
  • •`client.forwarding`: `configure()`, `secret()`, `rotateSecret()`, `test()`, `deliveries()`, `emailDeliveries()` and `redeliver()`
  • •`verifyForwardedEmail()` checks a forwarded email's Standard Webhooks signature and timestamp and returns the typed `email.received` event, throwing `WebhookVerificationError` otherwise
  • •`matchEmail()`, `isEmailRequest()` and `captureEmailDuring()` for tests
  • •New `@webhooks-cc/sdk/email` entry point with the email types, the finder and the JSON builder, and no network code
  • •Requests carry `kind` and `email`; `requests.list()`, `listPaginated()` and `search()` take `kind`, and `waitFor()` takes `since`
  • •`verifyStandardWebhookSignature()` accepts a Fetch `Headers`; it used to fail on one silently
  • •`requests.replay()` refuses emails, `export()` skips them, and provider detection ignores them
MCPv1.10.0

Email and Forwarding Tools

  • •`list_emails`, `get_email` and `wait_for_email` read the email an endpoint receives at mailhooks.cc, with the one-time code and main link picked out, so an agent can complete a signup or login flow itself
  • •`send_test_email` delivers a sample email, optionally to a +tag address
  • •`configure_forwarding`, `get_forwarding_secret`, `test_forwarding`, `list_deliveries` and `redeliver_email` manage email forwarding
  • •`list_requests`, `search_requests` and `count_requests` take `kind`; request tools and resources leave out an email's raw message and HTML part and cut its text, so one email cannot use up the output; `update_endpoint` takes `showEmailExtracts`
  • •`get_email` and `wait_for_email` put the code and link first and trim a large email to fit the output (headers, then extra codes, links, addresses and attachments, then HTML and text, then all but the essentials), so the result stays valid JSON; `wait_for_email` waits 30 seconds by default, under the usual client timeout; `list_emails` with a tag, subject or sender searches the newest 100 emails
  • •44 tools (SDK 1.12.0)
Web Appv0.33.0

Email Capture

  • •Every endpoint on an account now has an email address next to its HTTP URL, at mailhooks.cc. Mail sent there lands in the same request list as your webhooks and counts as one request. Add a tag after a plus sign, like slug+signup@mailhooks.cc, to tell flows apart
  • •Emails get their own view: a sandboxed preview where no scripts run and remote images only load when you ask, the text, headers, attachments, the raw message with a .eml download, and an Authentication tab that explains the SPF, DKIM and DMARC results
  • •One-time codes and the main link of each email are picked out above the preview with copy buttons. Turn this off per endpoint in Settings
  • •Switch the request list between all requests, HTTP and email. Send then Send test email delivers a sample message to try it
  • •Endpoint settings moved from a dialog to a Settings tab next to Requests, with one section per topic and a save button per section
  • •The endpoint bar shows both addresses with copy buttons, and the setup checklist moved into a Setup menu next to Send and Export
  • •The account page splits your usage into HTTP requests and emails
Web Appv0.32.20

Email Capture Groundwork

  • •Groundwork for capturing email at your endpoints: a captured request can now be an email, counted exactly like any other request. Nothing changes in the dashboard yet
Web Appv0.32.19

Seat Schedule Retries

  • •If reading a team's subscription from Polar fails while handling a webhook, the webhook now fails so Polar delivers it again, instead of leaving the seat schedule out of date until the next subscription event
Web Appv0.32.18

Seat Schedules Follow Polar

  • •A seat reduction scheduled or cancelled in Polar itself, for example from Polar's dashboard, now reaches the team's member cap. Polar does not change a subscription's modification time for these, so team billing now reads the subscription's current state from Polar on every subscription webhook
Web Appv0.32.17

Polar SDK 1.0

  • •Billing runs on version 1.0 of Polar's SDK, pinned to Polar API version 2026-10
  • •A seat increase that your bank must approve now says so, instead of reporting a declined card
  • •Polar calls wait up to 30 seconds instead of failing after 5, so a slow response no longer fails a checkout or seat change that Polar completes
  • •Correctly signed Polar webhooks of an unfamiliar type are acknowledged instead of rejected, so Polar never disables the endpoint over a new event type
Web Appv0.32.16

Privacy Policy, Terms, and Subprocessors

  • •The privacy policy names enkelt.design as the business behind webhooks.cc and says where data lives: our servers and backups in Germany, email through Denmark and Frankfurt, analytics in PostHog's EU region
  • •It now covers every kind of data we keep, the legal basis for each use, how long each is retained, your GDPR rights, how to complain to Datatilsynet, and how to request a data processing agreement
  • •A new /subprocessors page lists each company that handles data for us, what it receives, and where
  • •The terms name enkelt.design and add a governing law section (Danish law, with consumer protections kept)
  • •Sign-in event records are deleted after one year, like the rest of the audit trail (migration 00047)
Web Appv0.32.15

Accurate Sitemap Dates

  • •The sitemap now dates each /webhooks provider page by when its content last changed, instead of one shared date from July, so search engines can tell which pages are new
  • •The /webhooks hub takes the date of its newest provider page, /changelog the date of its newest entry, and docs pages edited on 2 October carry that date
Web Appv0.32.14

Provider Page Wording

  • •Provider page FAQs use "an" before names that start with a vowel, such as "an Amazon SNS webhook" and "an Adyen account"
Web Appv0.32.13

Resend and WorkOS Signature Verification

  • •Resend and WorkOS are now full providers: send signed sample webhooks from the dashboard, and set either one as an endpoint's signing provider so every captured request is verified (migration 00046)
  • •Resend verification uses its Svix headers and whsec_ signing secret; WorkOS verification reads the workos-signature header and uses the signing secret exactly as WorkOS shows it
  • •Request badges tell Resend apart from Clerk even though both deliver through Svix, and WorkOS requests show their event name
  • •Their /webhooks pages now offer sample templates and built-in verification instead of capture only
Web Appv0.32.12

10 More Provider Pages

  • •Webhook guides for Amazon SNS, PagerDuty, Okta, Segment, Datadog, Zapier, Make, Loops, Salesforce, and Customer.io, with where to configure each one and how it authenticates deliveries, taken from each provider's own developer docs
Web Appv0.32.11

Tighter Database Permissions

  • •Endpoints and API keys can no longer be created, changed, or deleted by calling the database API directly; every change goes through the app's own routes, which apply the rate limits, the guest endpoint and API key caps, input validation, and the audit trail (migration 00045)
Web Appv0.32.10

Faster Captures Under Load

  • •One account receiving a flood of webhooks no longer slows down capture for everyone else
  • •Captures write far less to the database, so the receiver handles more webhooks per second
  • •Fixed occasional 429 responses to the first webhooks of a free account's new daily period when several arrived at once
  • •Search within an endpoint reads only that endpoint's requests; searching a very large account for a rare term can take up to a second
Web Appv0.32.9

Live Updates over Broadcast

  • •Live dashboard and CLI stream updates now travel as small Realtime Broadcast signals on private, per-endpoint channels, instead of having the database check every change against every open dashboard
  • •Captures no longer fan out account and endpoint counter updates to open dashboards, so busy endpoints stay live under much higher traffic
  • •The account page refreshes its usage figure every 30 seconds and when you return to the tab; plan, billing and quota changes still show up immediately
Web Appv0.32.8

Calmer Live Dashboard

  • •On busy endpoints the dashboard refreshes the request list at most once a second instead of after every event
  • •The request count updates in the browser as webhooks arrive, so a busy endpoint no longer runs into the count rate limit and leaves the count stale
SDKv1.11.0

Resend and WorkOS Providers

  • •New `resend` provider: templates for `email.sent`, `email.delivered`, `email.bounced`, `email.clicked`, and `contact.created`, signed with the svix-* headers Resend sends; `verifyResendSignature()` and `isResendWebhook()`
  • •New `workos` provider: templates for `user.created`, `dsync.user.created`, `connection.activated`, `session.created`, and `organization.created`, signed as `workos-signature: t=<ms>, v1=<hex>`; `verifyWorkOSSignature()` and `isWorkOSWebhook()`
  • •Detection tells Resend apart from Clerk by body shape (both use Svix headers), and reads WorkOS event names from `event`
  • •`TEMPLATE_PROVIDERS` grows to 34 and `VERIFY_PROVIDERS` to 32
MCPv1.9.0

Resend and WorkOS Providers

  • •`send_webhook`, `send_to`, `preview_webhook`, and `list_provider_templates` support the `resend` and `workos` providers, and `verify_signature` verifies both (SDK 1.11.0)
Web Appv0.32.7

Dependency Security Updates

  • •Next.js moved to 16.3.6 for the critical advisory GHSA-vcvr-r3jv-pc5j
  • •Transitive dependency floors raised for @grpc/grpc-js (1.14.5), dompurify (3.4.16), ip-address (10.7.1), and brace-expansion (1.1.21, 2.1.7, and 5.0.12) to pick up their security fixes
  • •Routine dependency bumps: Supabase JS, resend, lucide-react, simple-icons, the development tooling group, plus the OpenTelemetry crates, redis, thiserror, and rand on the Rust side
Web Appv0.32.6

Container Images

  • •The web app and the receiver now build as self-contained Docker images, with the public URLs set at build time
  • •Both images run as a non-root user and report their own health
Web Appv0.32.5

Seat Removals Take Effect at Renewal

  • •Removing team seats now takes effect when the billing period ends: you keep the seats you paid for until then, and the subscription renews at the lower count
  • •The team page shows a scheduled seat reduction with a button to keep your current seats instead
Web Appv0.32.4

CI Guide Fix

  • •The CI/CD guide now names the hosts CI must reach, webhooks.cc and go.webhooks.cc, instead of a retired API hostname
Web Appv0.32.3

Seat Changes Are Confirmed and Charged Up Front

  • •Changing a team's seat count now asks for confirmation first and shows the exact amount charged to your card, or credited to your account, before anything happens
  • •Added seats are charged right away for the rest of the billing period instead of on the next invoice; a declined card adds no seats and says so
  • •Removed seats become account credit straight away, spent on your next charge before your card
  • •The team owner now holds one of the team's seats in the billing system too, matching the member count shown on the team page
Web Appv0.32.2

Support Audit Trail

  • •Team, billing, API key, and endpoint changes are now recorded in an internal audit trail, so support questions like "what happened to my invite" can be answered precisely
  • •Daily request counts per endpoint are kept after request history expires, including how many webhooks were rejected because a quota ran out
Web Appv0.32.1

Quota Email Fix

  • •Quota emails now go out: the setting that turns them on was not being read
Web Appv0.32.0

Quota Alerts and 26 New Provider Pages

  • •When your request limit runs out, the dashboard now says so: a banner shows that new webhooks are rejected with HTTP 429 and when the limit resets
  • •Free accounts also get an email when their daily limit runs out, at most once a week
  • •Webhook guides for 26 more providers, including Resend, Zoom, Jira, Notion, WorkOS, WooCommerce, Paystack, and Checkout.com, with setup steps and how each one authenticates deliveries
Web Appv0.31.3

Single Sitemap

  • •The sitemap index and its three child sitemaps are replaced by one /sitemap.xml, which robots.txt now points to; the old sitemap URLs redirect to it
Web Appv0.31.2

Dependency Updates

  • •The Scalar API reference upgrade pulls in undici, which is now held at 7.29 or later so it does not arrive with four high-severity advisories
  • •Routine dependency bumps: React and React DOM, Supabase JS, zod, posthog-js, resend, AppSignal, lucide-react, tailwind-merge, simple-icons, Scalar API reference, swagger-parser, and dotenv 18, plus redis and crc32fast on the Rust side
CLIv1.3.1

Dependency Updates

  • •Rebuilt on current dependencies: clap 4.6.7, clap_complete 4.6.11, open 5.4.4, and dirs 7
  • •No behaviour changes: your saved login stays where it was, since dirs 7 resolves the config directory the same way as before
Web Appv0.31.1

Style Experiment Reporting

  • •The visual-style split now reports its arm under the variant keys PostHog expects, so the experiment results line up
Web Appv0.31.0

A Clean Visual Style

  • •A second visual style: switch between the bold classic look and a clean one with thin borders, rounded corners, soft shadows, and sentence-case labels
  • •The style switch sits next to the light and dark mode switch in the header, works with both modes, and is remembered in your browser
Web Appv0.30.1

Dependency Security Updates

  • •Nodemailer moved to 10.x, closing the address-parser denial of service, the recipient-domain validation bypasses, and the file-access bypass reported against earlier releases
  • •Transitive dependency floors raised for hono (4.13.5), js-yaml (3.15.2 and 4.3.2), and @ai-sdk/provider-utils (4.0.33) to pick up their security fixes
  • •Routine dependency bumps: Next, jose, Supabase SSR, zod, lucide-react, posthog-js, resend, simple-icons, vitest 5, swagger-parser 13, Playwright, tsx, postcss, plus tower-http, constant_time_eq, and open on the Rust side
Web Appv0.30.0

Search Finds Requests on Shared Endpoints

  • •Searching and counting requests now covers endpoints shared with you through a subscribed team, in the dashboard and through the API, instead of only endpoints you own (migration 00039)
  • •Requests on shared endpoints follow the endpoint owner's retention, not the searcher's plan, matching what the request list already shows team members
  • •Endpoints shared with you now also carry `fromTeams`, every one of your subscribed teams the endpoint is shared with, alongside the existing `fromTeam` (the oldest share)
  • •Teams docs gained a section on working with shared endpoints from the CLI, SDK, and MCP server; the OpenAPI description of endpoint listing no longer says shared endpoints need a Pro plan
CLIv1.3.0

Teams from the Terminal

  • •New `whk teams` commands: `list` shows your teams with seats, pooled usage, and status; `members <team>` lists members and pending invites; `share <slug> --team <team>` and `unshare` manage sharing; `invite <team> <email>`, `invites`, `accept`, and `decline` handle invites. Teams are addressed by id or by name
  • •`whk list --team <team>` keeps only the endpoints tied to one team, whether shared with you from it or yours shared with it; the team is resolved the same way as in `whk teams`, so an unknown or ambiguous name is an error
  • •`whk teams invite` reports when the invite was created but its email could not be sent, instead of claiming the invitee was notified
  • •`whk usage` prints the pooled quota of every subscribed team you belong to under your personal plan, and `--json` adds a `teams` array (plus `teamsError` if the pools could not be loaded)
  • •`whk requests search` and `count` now find requests on endpoints shared with you (server-side change in web 0.30.0)
  • •Fixed `whk requests search`, which failed to parse the search response since the API started returning a plain array; each hit now shows its endpoint slug
SDKv1.10.0

Teams Namespace

  • •New `client.teams` namespace: `list()` returns your teams with seats and pooled `requestsUsed`/`requestLimit`; `members(teamId)`, `share(teamId, slug)`, `unshare(teamId, slug)`, `invite(teamId, email)`, and `invites.list/accept/decline` mirror the team routes. Share and unshare take a slug and resolve the endpoint id for you
  • •`endpoints.list({ team })` keeps only endpoints tied to a team id or unique name (resolved through `teams.list()`, so an unknown or ambiguous name throws), matched against `fromTeams`, `fromTeam`, and `sharedWith`; `Endpoint.fromTeams` is new and lists every one of your teams a shared endpoint belongs to
  • •New `Team`, `TeamMember`, `TeamInvite`, `TeamMembers`, and `ListEndpointsOptions` types; `TeamInvite.warning` is set when the invite was created but its email could not be sent; `describe()` documents the teams operations
  • •`requests.search` and `requests.count` now return requests on endpoints shared with you (server-side change in web 0.30.0)
MCPv1.8.0

Team Tools

  • •Four new tools: `list_teams` (seats, pooled usage, status), `list_team_members`, `share_endpoint`, and `unshare_endpoint`, bringing the tool count to 35. Invites stay out of MCP because accepting one claims a paid seat
  • •`list_endpoints` accepts an optional `team` (id or name) to keep only that team's endpoints
  • •`get_usage` adds a `teams` array with the pooled quota of every subscribed team you belong to; if the team list cannot be loaded the personal usage is still returned with a `teamsError`
  • •`search_requests` and `count_requests` now find requests on endpoints shared with you (server-side change in web 0.30.0)
Web Appv0.29.2

Webhook Total No Longer Drops on Deletion

  • •The webhooks-processed total on the landing page kept the counts of endpoints removed by the guest cleanup but lost them when you deleted an endpoint or your account; counts from every deleted endpoint are now preserved (migration 00038)
Web Appv0.29.1

Security and Reliability Fixes from the Architecture Review

  • •Database privileges hardened: signed-in users can no longer update their own plan or limits through the database API, and every stored procedure is callable by the server only (migration 00037)
  • •Team members now receive live dashboard updates for endpoints shared with their team instead of having to refresh
  • •Guest endpoint reads no longer expose ephemeral endpoints that belong to a signed-in user
  • •Deleting an account now cancels the Pro subscription and the subscriptions of teams you own first, and refuses to delete if that fails, instead of leaving them billing
  • •Endpoint lookups by slug use a proper index again (the hottest query in the receiver)
  • •Webhooks whose body, path or query contain a NUL byte are stored (raw bytes preserved) instead of being silently dropped with a 200
  • •The receiver answers 503 with Retry-After on transient database failures so senders retry, and reports capture outcomes as metrics
  • •Rate limits are keyed on the Cloudflare client IP, so a forged X-Forwarded-For no longer bypasses them
  • •The landing page syncs guest endpoints by polling instead of holding a Realtime channel that could never deliver
CLIv1.2.0

Tunnels That Stay Up

  • •`whk tunnel` and `whk listen` reconnect automatically: the server rotates stream connections every 30 minutes, and the CLI now resumes from the last request it saw instead of stopping silently
  • •Network errors and stream drops retry with backoff and are reported; authentication and not-found errors exit non-zero with a message instead of exiting 0
  • •A stream that goes quiet for 90 seconds (no keepalive) is treated as dead and reconnected
  • •`whk tunnel` keeps the endpoint it created unless you pass `--ephemeral`, and prints how to reuse or delete it on exit
SDKv1.9.1

Streams Survive the 30-Minute Rotation

  • •`requests.subscribe(slug, { reconnect: true })` now reconnects transparently when the server rotates the connection (every 30 minutes) and resumes from the last request it saw; previously the iterator ended silently
  • •New `idleTimeout` option (default 90s): a stream with no keepalive for that long is reconnected (or ends with a TimeoutError when `reconnect` is off) instead of hanging forever
  • •Reconnects no longer accumulate abort listeners on the outer signal
Web Appv0.29.0

Sign In with Email and Password

  • •Create an account with an email address and password, alongside GitHub and Google: sign-up sends a confirmation link, and the account is usable once the email is verified
  • •Forgot password? Request a reset link from the login page and choose a new password on the reset page; the link works in any browser
  • •Team invitees without a GitHub or Google account can now sign up with the invited email address and the invite is waiting for them
  • •OAuth errors and invalid email links now show a message on the login page instead of being dropped
Web Appv0.28.1

Fix: Team Checkout for Owners Who Already Have a Polar Customer

  • •Team checkout no longer fails for owners who already have a personal Pro subscription (or own another team): the team's Polar customer is now created as a team customer with the owner as its owner member, instead of a second customer on the owner's email, which Polar rejects
  • •Team billing errors now reach the browser with their detail instead of being swallowed by Cloudflare's 502 page
  • •Polar errors are logged without the request's authorization header
Web Appv0.28.0

Invite Anyone to Your Team by Email

  • •Team invites no longer require the invitee to have an account: invite any email address, they get an invite email, and signing up with that address links the invite to their new account automatically
  • •Invite emails tell the invitee who invited them, to which team, and where to accept
  • •Clicking Subscribe again within 30 minutes reuses the open checkout session for the same seat count instead of creating a second one, and the billing webhook ignores events from a subscription the team doesn't hold
  • •Pro renewals now reset the monthly request counter the moment the renewal lands instead of relying on a background sweep
  • •When a member leaves or is removed, the endpoints they shared with the team are unshared so their traffic stops drawing from the team pool
  • •Checkout failures now surface Polar's validation detail (e.g. a rejected billing email) instead of a bare error
Web Appv0.27.0

Teams Is Now Its Own Seat-Based Plan

  • •Teams no longer requires Pro — any account can create a team, and the team carries its own subscription at $12/seat/mo
  • •Every seat adds 100,000 requests per 30 days to a pool shared by the whole team: requests on team-shared endpoints bill the team instead of the endpoint owner
  • •Seats are the member cap — add a seat to add a member, and freed seats are reusable
  • •Team-billed requests are kept for 31 days regardless of the endpoint owner's plan
  • •Per-team billing through Polar: subscribe, adjust seats, cancel, and resubscribe from the team page
  • •A team without an active subscription is suspended — its data is kept, but invites, sharing, and member access to shared endpoints pause until it subscribes
Web Appv0.26.3

Security: dependency updates across the stack

  • •Next.js 16.2.11, patching several security advisories in the framework
  • •All open Dependabot security alerts resolved: hardened transitive dependencies (sharp, tar, js-yaml, dompurify, hono, and friends) via lockfile overrides
  • •Routine dependency refresh: React 19.2.8, Supabase SSR, Radix UI, Polar SDK, PostHog, and the Rust receiver/CLI dependency set (including a quinn-proto advisory fix)
Web Appv0.26.2

Fix: CLI login no longer locks out at the API key cap

  • •CLI device logins at the 10-key limit now rotate the oldest CLI-issued key instead of failing with an opaque “Claim failed” — manually created keys are never touched
  • •When a claim does hit the cap (all keys manually created), the CLI now shows an actionable message pointing to the account page instead of “Claim failed”
CLIv1.1.3

Self-Update Rescue for v0.x Installs

  • •Releases again include the legacy `whk_<os>_<arch>` archives (with checksums), so `whk update` works from pre-1.0 installs — v0.6.0 users stuck on “no release asset for darwin/arm64” can now update straight to the current version
  • •No binary changes — identical CLI code to 1.1.2
Web Appv0.26.1

Fix: stale delete button in endpoint settings

  • •Fixed the endpoint settings dialog showing a disabled “Deleting...” button when opening another endpoint's settings right after deleting one — previously only a page reload cleared it
Web Appv0.26.0

The Landing Page Is Now the Dashboard

  • •Visit webhooks.cc and you're in the inspector: a live guest webhook URL is created the moment you arrive — no signup — with the full request dashboard (live feed, body tree, headers, replay) filling the first screen
  • •One-click test sends from the empty state: a custom payload or signed Stripe, GitHub, and Shopify templates, plus a copy-able curl command
  • •One click with GitHub or Google keeps your guest endpoint and unlocks the free plan — messaging now spells this out at every step, including a guest-vs-free comparison
  • •/go retired: it permanently redirects to the landing page, which now provides the same experience
  • •Crawler protection: guest endpoints are no longer created for bots (server-side user-agent screen + creation waits for a human input signal)
  • •SEO: HowTo structured data, new FAQ entries, and an instant-URL page title and description
Web Appv0.25.0

Landing Redesign + Per-Provider Webhook Pages

  • •New provider pages at /webhooks — setup steps, signature details, and sample events for all 32 supported providers, plus a browsable hub grouped by category
  • •Landing page redesigned around a sign-up-first hero: prominent GitHub/Google start-free buttons, with the no-signup guest endpoint as the secondary path
  • •New provider strip and navbar links (Docs, Providers, Compare, Pricing, Blog) for easier discovery
  • •SEO: provider pages added to the sitemap, /agent/claim marked noindex
Web Appv0.24.0

4 New Providers — DocuSign, Adyen, PayPal, Plaid

  • •Provider catalog grows from 28 to 32: added DocuSign, Adyen, PayPal, and Plaid across templates and detection
  • •Server-side signature verification now supports DocuSign HMAC, Adyen body-embedded HMAC, and PayPal RSA certificate verification; Plaid remains template-only until Plaid JWT/JWK credentials are supported
  • •Endpoint settings and the Signature tab use provider-specific credential labels, including PayPal Webhook ID and Adyen HMAC Key
SDKv1.9.0

4 New Providers — DocuSign, Adyen, PayPal, Plaid

  • •Added DocuSign, Adyen, PayPal, and Plaid templates, bringing TEMPLATE_PROVIDERS to 32 named providers
  • •New verifiers: verifyDocuSignSignature, verifyAdyenSignature, and verifyPayPalSignature with PayPal certificate URL validation and RSA-SHA256 verification
  • •New detection helpers: isDocuSignWebhook, isAdyenWebhook, isPayPalWebhook, and isPlaidWebhook; Plaid remains template-only for verification
MCPv1.7.0

4 New Providers

  • •DocuSign, Adyen, PayPal, and Plaid are available in provider template tools through the SDK catalog; verify_signature now exposes DocuSign, Adyen, and PayPal while keeping Plaid template-only
Web Appv0.23.1

Fix: send-webhook templates for newer providers

  • •Fixed the dashboard send-webhook dialog failing with “Unsupported template "custom"” for 14 providers (HubSpot, Square, Meta, Lemon Squeezy, Coinbase Commerce, Razorpay, Cal.com, Intercom, Telegram, Mailgun, Calendly, Mux, Sentry, Bitbucket) — their template presets now derive from the SDK provider metadata so every listed provider can send a signed test webhook
Web Appv0.23.0

Agent Registration — sandbox, claim codes, SMTP email

  • •Unclaimed agent credentials now work immediately in a bounded sandbox: an anonymous key can create ephemeral endpoints and read only its own captured requests, with strict cross-tenant isolation, before a human claims it
  • •Anonymous registrations get a short human-friendly claim code (e.g. ABCD-EFGH) alongside the claim link — a signed-in user can claim by typing the code at /agent/claim
  • •Verification emails (OTP) now send over SMTP in production (SMTP → Resend → dev fallback); local dev and tests keep using the in-process capture transport
  • •Documented the ID-JAG trusted-provider config format and added an identity-provider onboarding section to the hosted /auth.md
SDKv1.8.0

Agent self-registration on-ramp

  • •New static WebhooksCC.register helpers let an agent obtain its own credential before it has one: anonymous (with claim code + poll/waitForClaim), verified_email (withEmail + confirmEmailOtp), and identity_assertion (withIdJag)
  • •WebhooksCC.describeRegistration() and client.describe().registration surface the auth.md on-ramp so an unauthenticated agent can discover how to register
  • •Standalone exports (registerAnonymous, registerWithEmail, confirmEmailOtp, registerWithIdJag, pollClaim, waitForClaim) plus an AgentRegisterError carrying the auth.md error code
MCPv1.6.0

Agent self-registration on-ramp

  • •New unauthenticated tools — how_to_register, register_agent, and check_claim — let an agent with no API key learn the auth.md flows and drive the anonymous register + claim handshake
  • •The MCP server now boots without WHK_API_KEY, exposing only the registration on-ramp so an agent can obtain a credential instead of failing to start
  • •describe now includes the registration on-ramp block from the SDK
Web Appv0.22.0

Agent Registration — auth.md (anonymous, verified email, ID-JAG)

  • •Implements the WorkOS auth.md agent-registration protocol: agents self-register a credential anonymously, via a verified-email one-time code, or by presenting a provider-signed ID-JAG identity assertion
  • •Adds RFC 9728 discovery (/.well-known/oauth-protected-resource and /.well-known/oauth-authorization-server), a hosted /auth.md, and a WWW-Authenticate hint on 401s so agents can discover how to authenticate
  • •Anonymous credentials can be claimed by a signed-in user from an in-app claim page, permanently attaching the key to their account
  • •Supports provider-driven revocation (logout token) for ID-JAG-issued credentials
Web Appv0.21.0

7 New Providers — Square, HubSpot, Mailgun, Calendly, Mux, Sentry, Bitbucket

  • •Provider catalog grows from 21 to 28: added Square, HubSpot, Mailgun, Calendly, Mux, Sentry, and Bitbucket across templates, auto-detection, and signature verification
  • •Three new signing schemes are now supported server-side: URL + body (Square), HTTP method + URI + body + timestamp (HubSpot), and body-embedded signature fields (Mailgun)
  • •Endpoint settings, the send-webhook dialog, and the Signature tab list all 28 named providers; automatic server-side verification works for every one except SendGrid (IP allowlisting)
  • •Refreshed provider template and signature-verification docs with payload shapes, headers, and algorithms for each new provider
Web Appv0.20.4

7 New Providers — Meta, Lemon Squeezy, Coinbase Commerce, Razorpay, Cal.com, Intercom, Telegram

  • •Provider catalog grows from 14 to 21: added Meta (WhatsApp/Messenger/Instagram), Lemon Squeezy, Coinbase Commerce, Razorpay, Cal.com, Intercom, and Telegram across templates, auto-detection, and signature verification
  • •Endpoint settings, the send-webhook dialog, and the Signature tab now list all new providers; server-side automatic verification works for every one
  • •Refreshed provider template and signature-verification docs with payload shapes, headers, and algorithms for each new provider
SDKv1.7.0

7 New Providers — Square, HubSpot, Mailgun, Calendly, Mux, Sentry, Bitbucket

  • •Added Square, HubSpot, Mailgun, Calendly, Mux, Sentry, and Bitbucket to templates, detection, and verification — the catalog now covers 28 named providers
  • •New verifiers: verifySquareSignature, verifyHubSpotSignature, verifyMailgunSignature, verifyCalendlySignature, verifyMuxSignature, verifySentrySignature, verifyBitbucketSignature
  • •New detection helpers: isSquareWebhook, isHubSpotWebhook, isMailgunWebhook, isCalendlyWebhook, isMuxWebhook, isSentryWebhook, isBitbucketWebhook
  • •VerifySignatureOptions gains an optional method field; Square and HubSpot verification require the request url (HubSpot also uses the method and rejects timestamps older than 5 minutes)
  • •Bitbucket is detected on x-event-key before Intercom to avoid the shared x-hub-signature collision (Bitbucket sha256=, Intercom sha1=)
SDKv1.6.0

7 New Providers

  • •Added Meta (WhatsApp/Messenger/Instagram), Lemon Squeezy, Coinbase Commerce, Razorpay, Cal.com, Intercom, and Telegram to templates, detection, and verification
  • •New verifiers: verifyMetaSignature, verifyLemonSqueezySignature, verifyCoinbaseCommerceSignature, verifyRazorpaySignature, verifyCalSignature, verifyIntercomSignature, verifyTelegramSignature
  • •New detection helpers: isMetaWebhook, isLemonSqueezyWebhook, isCoinbaseCommerceWebhook, isRazorpayWebhook, isCalWebhook, isIntercomWebhook, isTelegramWebhook
  • •Meta is detected by body shape (ordered before GitHub); Intercom (sha1=) is disambiguated from GitHub's x-hub-signature-256 and Bitbucket's sha256=
MCPv1.5.0

7 New Providers — Square, HubSpot, Mailgun, Calendly, Mux, Sentry, Bitbucket

  • •Square, HubSpot, Mailgun, Calendly, Mux, Sentry, and Bitbucket are now available in send_webhook, send_to, preview_webhook, list_provider_templates, and verify_signature — wired automatically through the SDK provider lists, bringing the catalog to 28 named providers
MCPv1.4.2

7 New Providers

  • •Meta, Lemon Squeezy, Coinbase Commerce, Razorpay, Cal.com, Intercom, and Telegram are now available in send_webhook, send_to, preview_webhook, list_provider_templates, and verify_signature — wired automatically through the SDK provider lists
Web Appv0.20.3

CLI v1.1.2 Release

  • •Ships the CLI v1.1.2 polish — correct version display in `whk update` and a clear, actionable message when the install directory isn't writable
CLIv1.1.2

Update Command Polish

  • •`whk update` now displays the current version correctly (was rendering as `vv1.0.0` due to a double `v` prefix)
  • •When the install directory isn't user-writable, `whk update` fails fast with a clear message naming the path and suggesting `sudo whk update` or a user-writable reinstall — instead of the cryptic `Permission denied (os error 13)` after a multi-MB download
Web Appv0.20.2

MCP v1.4.1 & CLI v1.1.1 Release

  • •MCP and CLI version bumps ship transitive dependency upgrades — zod 4 in MCP, tokio 1.52 and rustls-webpki refresh in the CLI
CLIv1.1.1

Dependency Maintenance

  • •tokio 1.51 → 1.52, rustls-webpki refresh, axum 0.8.9, rand 0.8.6, clap 4.6.1, clap_complete 4.6.5, open 5.3.5 — picks up upstream security fixes
  • •Internal clippy 1.95 cleanups in the TUI event loop and update screen (no behavior change)
MCPv1.4.1

zod 4 Upgrade

  • •Upgrades the zod dependency from 3.x to 4.x with the matching tool-schema adaptation in src/tools.ts
Web Appv0.20.1

CI hardening & lint cleanup

  • •CI: Build Web App job now uses placeholder env values when Supabase secrets aren't available (e.g. Dependabot PRs), so dependency-update PRs get a meaningful build signal
  • •Resolved new strict react-hooks lint errors surfaced by an upcoming plugin bump, keeping the workspace lint-clean across plugin versions
Web Appv0.20.0

Provider Auto-Detect & Typeform Support

  • •Dashboard auto-detects the webhook provider from headers and payload and renders a colored provider badge on each request
  • •Provider icons (Stripe, GitHub, Shopify, Twilio, Slack, Paddle, Linear, Clerk, Discord, Vercel, GitLab, Typeform, and more) across the request list and detail panes
  • •Typeform added to provider templates and signature verification — configure on any endpoint
  • •Hardened signing configuration invariants: partial or stale provider state is no longer possible, eliminating a class of silent verification failures
  • •Refreshed provider docs, ngrok and webhook.site comparison guides, signature verification guide, and MCP tools reference
SDKv1.5.0

Typeform Provider & Webhook Auto-Detect

  • •Typeform provider templates (form_response, partial_response, payment) and verifyTypeformSignature
  • •detectWebhookInfo() and detectWebhookProvider() helpers for provider auto-detection from headers and body
  • •DetectedWebhookInfo type and isTypeformWebhook detection helper
MCPv1.4.0

Typeform Provider Support

  • •Typeform exposed in list_provider_templates with templates, default event, and signature metadata
  • •Typeform usable in create_endpoint and update_endpoint signing config
Web Appv0.19.1

Guest Dashboard SEO Overhaul

  • •Fixed layout bug on /go where hero copy rendered above the navbar
  • •Added feature cards flanking the Send Your First Webhook widget — mock responses, signature verification, CLI tunnel, SDK testing, MCP, and search/replay — visible without scrolling on xl+ screens
  • •Expanded server-rendered SEO content (14 internal doc links, 12 headings, 751 words, BreadcrumbList + FAQPage schemas, hreflang alternates)
  • •Promoted the page h1 to a visible subtitle inside the nav on md+ screens
CLIv1.1.0

Signature Verification

  • •Tunnel forwards X-Signature-Verified, X-Signature-Provider, and X-Signature-Error headers
  • •Listen shows inline verification status (checkmark/cross) per request
  • •Create supports --signing-provider and --signing-secret flags (or WHK_SIGNING_SECRET env var)
SDKv1.4.0

Signature Verification Matchers

  • •matchVerified() and matchUnverified() matchers for signature verification assertions
  • •signatureVerified, signatureError, and signingProvider fields on Request and Endpoint types
MCPv1.3.0

Signature Verification Tools

  • •Signing config (provider + secret) on create_endpoint and update_endpoint
  • •verify_signature tool returns stored server-side results with skipped detection
  • •Discord publicKey support for Ed25519 verification
Web Appv0.19.0

Signature Verification

  • •Server-side webhook signature verification for 13 providers — configure once per endpoint, every request verified automatically
  • •New Signature tab in request detail: paste a secret for instant client-side verification, or view stored server-side results with detailed error diagnostics
  • •Verification badges (shield icons) in the request list and summary bar for at-a-glance valid/invalid status
  • •Signing configuration section in endpoint settings: provider dropdown, encrypted secret storage, provider-specific tips
  • •SDK: matchVerified() and matchUnverified() matchers for test assertions
  • •MCP: verify_signature returns stored results without needing a secret; create/update endpoints with signing config
  • •CLI: X-Signature-Verified headers on tunnel, verification status in listen output, --signing-provider/--signing-secret on create
Web Appv0.18.3

Blog Resilience & Housekeeping

  • •Blog pages gracefully fall back when Supabase is unreachable instead of erroring
  • •Added SECURITY.md and CODE_OF_CONDUCT.md for open-source governance
Web Appv0.18.2

SDK v1.3.0 & MCP v1.2.0 Release

  • •Updated llms.txt and llms-full.txt with conditional response rules documentation
  • •SDK and MCP version bumps for response rules and provider consolidation
Web Appv0.18.1

Blog Page Redesign

  • •Redesigned blog index with clear visual hierarchy: featured post, two latest cards, and a scannable list for all posts
  • •Compact page header replacing the bulky hero section
  • •Fixed blog posts not appearing after publish due to stale Next.js fetch cache
Web Appv0.18.0

Conditional Response Rules

  • •Define ordered response rules that match on method, path, headers, or body — first match wins
  • •Visual response rules editor in endpoint settings with drag-to-reorder
  • •Rules evaluated in the Rust receiver for low-latency conditional responses
  • •Full SDK, MCP, and API support for managing response rules
SDKv1.3.0

Response Rules & Provider Consolidation

  • •ResponseRule and ResponseRuleCondition types for conditional mock responses
  • •validateResponseRules() and validation constants exported for shared use
  • •TEMPLATE_PROVIDERS, VERIFY_PROVIDERS, and buildTemplateSendOptions exports — single source of truth for provider logic
  • •Notification URL support in create/update endpoint options
  • •Raw body replay with byte-exact fidelity (base64-decoded bodyRaw)
MCPv1.2.0

Response Rules & Notifications

  • •Response rules support in create_endpoint and update_endpoint tools
  • •Notification URL parameter for endpoint creation and updates
  • •Provider lists imported from SDK — single source of truth
Web Appv0.17.4

SEO & Accessibility Improvements

  • •Custom 404 page, OG image optimization (PNG→JPG), and improved sitemap generation
  • •Comprehensive structured data (JSON-LD) and meta tag improvements across all pages
  • •LLMs-full.txt for AI agent discoverability
Web Appv0.17.3

Configurable Limits & Security Hardening

  • •Endpoint creation rate limits, ephemeral caps, and receiver body size now configurable via env vars
  • •Stored XSS regression test suite for endpoint names, mock responses, and request data
Web Appv0.17.2

Teams Module Refactor

  • •Atomic team invite acceptance with member limit enforcement (max 25)
  • •Split teams module into focused sub-modules for better maintainability
Web Appv0.17.1

Consolidated Provider Logic

  • •Unified webhook provider lists, signing, and payload generation via SDK — single source of truth
  • •Added standard-webhooks provider to Send Webhook dialog (fixes drift from SDK/MCP)
  • •Shared mock response validation across endpoint routes using SDK constants
Web Appv0.17.0

Redis-Backed Rate Limiting

  • •Distributed rate limiting via Redis sliding window for all API routes
  • •Receiver notification deduplication backed by Redis
  • •Graceful fallback to in-memory rate limiting when Redis is unavailable
Web Appv0.16.0

Raw Body Fidelity & Search Performance

  • •Raw body storage for non-UTF-8 payloads preserves byte-exact fidelity
  • •Trigram-indexed full-text search across request path, body, and headers
  • •Improved SSE streaming with raw body support
  • •SDK version drift fix and accurate Retry-After headers
Web Appv0.15.0

Notification Webhooks

  • •Configure a notification URL on any endpoint to receive POST alerts when webhooks are captured
  • •Supports Slack, Discord, Microsoft Teams, and any webhook-compatible service
  • •Notification URL management in endpoint settings and via API/SDK/MCP
  • •New docs page for notification webhooks
Web Appv0.14.1

API Key Deletion Confirmation

  • •Added confirmation dialog before deleting API keys to prevent accidental revocation
CLIv1.0.0

Rust Rewrite

  • •Complete rewrite from Go to Rust for faster startup and smaller binaries
  • •Full feature parity: tunnel, listen, auth, endpoints, requests, replay, send, update
  • •Interactive TUI with ratatui (search, endpoint detail, request viewer)
  • •Request search and filtering in TUI
  • •Send webhooks with provider template signing from TUI
Web Appv0.14.0

API Explorer & Rate Limiting

  • •Interactive API explorer at /api-explorer powered by Scalar
  • •OpenAPI 3.1.0 specification at /openapi.yaml
  • •Improved rate limiting with sliding window and informational headers
  • •SDK error messages now include rate limit details and Retry-After hints
SDKv1.2.1

Rate Limit Metadata

  • •RateLimitError now includes limit, remaining, and reset fields
  • •New RateLimitMeta type export
Web Appv0.13.1

Pricing Copy Updates

  • •Updated pricing copy across comparison pages and docs
  • •Teams highlighted as Pro-exclusive feature
Web Appv0.13.0

Teams

  • •Create and manage teams with invite-based membership
  • •Share endpoints with team members
  • •Team roles: owner and member with scoped permissions
  • •Endpoint switcher shows personal and team endpoints
  • •Teams documentation page
CLIv0.6.0

Teams Support

  • •Endpoint list shows owned and team-shared endpoints
  • •TeamShare metadata in endpoint responses
SDKv1.2.0

Teams Support

  • •TeamShare type for endpoint team metadata
  • •Endpoint type includes sharedWith and fromTeam fields
Web Appv0.12.1

Comparison Pages Expansion

  • •New comparison pages: Hookdeck, localtunnel, RequestBin, Smee
  • •Redesigned Beeceptor, ngrok, and Webhook.site comparison pages
  • •Shared comparison CTA component
Web Appv0.12.0

Request Debugging Tools

  • •Pin requests to keep them visible across endpoint switches
  • •Add notes to captured requests (stored locally)
  • •Side-by-side request diff comparison
  • •Visual request timeline view
  • •Interactive dashboard guide
  • •Dashboard features documentation page
Web Appv0.11.0

Dashboard Improvements

  • •Keyboard shortcuts for dashboard navigation
  • •Collapsible JSON tree viewer for request bodies
  • •JSON to TypeScript type generation
  • •Resizable split pane in request viewer
  • •Richer request list rows with method badges and size
Web Appv0.10.1

Case-Insensitive Slugs

  • •Endpoint slugs are now case-insensitive (e.g. /w/AbC and /w/abc resolve to the same endpoint)
Web Appv0.10.0

Conversion Funnel & Live Preview

  • •Live webhook preview on landing page
  • •Getting started guide for new users
  • •Claim ephemeral endpoints after signing in
  • •Site stats social proof on landing page
  • •Pricing CTA and docs CTA components
  • •Redesigned hero and navigation
Web Appv0.9.3

Docs Expansion

  • •REST API reference documentation page
  • •Plans & limits documentation page
  • •Webhook.site vs webhooks.cc comparison page
  • •Docs navigation restructure and consistency improvements
Web Appv0.9.2

Changelog & Version Display

  • •Public changelog page at /changelog with track filtering
  • •Version display on account page
  • •Deep health check endpoint for AppSignal uptime monitoring
  • •Forward user IP on test webhook sends
  • •Status page link in footer
Web Appv0.9.1

Provider Templates & Mock Response Delay

  • •Add SendGrid, Clerk, Discord, Vercel, GitLab provider templates (12 total)
  • •Configurable response delay for mock responses (0-30s)
  • •Comprehensive analytics tracking for request and endpoint operations
  • •New provider template reference documentation page
SDKv1.1.0

New Provider Templates

  • •Add SendGrid, Clerk, Discord, Vercel, GitLab provider templates
  • •Detection helpers: isSendGridWebhook, isClerkWebhook, isVercelWebhook, isGitLabWebhook
  • •Signature verification: verifyClerkSignature, verifyVercelSignature, verifyGitLabSignature
  • •Mock response delay field
MCPv1.1.0

New Provider Templates

  • •Add SendGrid, Clerk, Discord, Vercel, GitLab to template and verify providers
  • •Mock response delay support
Web Appv0.9.0

AppSignal & Next.js 16 Proxy

  • •Replace Sentry with AppSignal for EU data residency compliance
  • •OpenTelemetry tracing pipeline for Rust receiver
  • •Migrate Next.js middleware.ts to proxy.ts (Next.js 16)
  • •Proxy test webhook sends through server-side API route
CLIv0.5.3

Tunnel Base Path & TUI Fixes

  • •Support base path in tunnel target (e.g. whk tunnel 8080/api/webhooks)
  • •Fix TUI tunnel input swallowing shortcut-bound keys
CLIv0.5.2

Custom Headers

  • •Add -H/--header flag for injecting custom headers in tunnel forwarding
SDKv1.0.1

Proxy & Delay

  • •Mock response delay field support
  • •Minor type and documentation fixes
MCPv1.0.1

Delay & Fixes

  • •Mock response delay support in update_endpoint tool
  • •Minor schema fixes
Web Appv0.8.0

Docs Overhaul

  • •14 new documentation pages with MDX pipeline
  • •Standard Webhooks provider and sendTo method
  • •Dynamic blog system with API publishing
  • •PostHog analytics integration
  • •Receiver file logging with daily rotation
  • •Adjusted tier quotas (guest 25/12hrs, free 50/day, pro 100K/month)
SDKv1.0.0

Stable API

  • •WebhookFlowBuilder for multi-step test scenarios
  • •Request export (JSON, HAR) and clear methods
  • •Full-text search and count queries
MCPv1.0.0

Stable API

  • •Standard Webhooks provider support
  • •Batch endpoint create/delete tools
  • •Request export, search, and clear tools
  • •Setup commands for Cursor, VS Code, Windsurf, Claude Desktop, Codex
SDKv0.6.0

Build Request & Fixes

  • •buildRequest method for constructing signed webhook requests
  • •Fix raw secret detection for Standard Webhooks
  • •Request diffing (diffRequests)
SDKv0.5.0

Standard Webhooks & sendTo

  • •Standard Webhooks provider and sendTo method
  • •matchContentType, matchQueryParam, matchBodySubset matchers
  • •Provider template sending with signed headers
MCPv0.3.0

Signature & Templates

  • •verify_signature tool for 9 providers
  • •send_webhook with provider template signing
  • •compare_requests and extract_from_request tools
Web Appv0.7.4

SEO & Navigation Refresh

  • •Refresh site metadata and navigation layout
  • •Fix sitemap response content
Web Appv0.7.3

Webhook Templates & Retention

  • •Signed webhook templates (Stripe, GitHub, Shopify, Twilio, Slack, Paddle, Linear)
  • •Request retention policy improvements
  • •Homepage comparison section
SDKv0.4.0

Signature Verification

  • •verifySignature for Stripe, GitHub, Shopify, Twilio, Slack, Paddle, Linear
  • •Webhook templates with realistic payloads
MCPv0.2.0

Webhook Templates

  • •Provider template support in send_webhook
  • •list_provider_templates tool
CLIv0.5.1

Replay & Ephemeral

  • •Add whk replay command to resend captured requests
  • •Add --ephemeral flag for auto-deleting tunnel endpoints
Web Appv0.7.2

SEO & Search

  • •Structured data (JSON-LD), FAQ section, breadcrumbs
  • •Add llms.txt for AI discovery
  • •Full-text search across request body, headers, and path
  • •Paginated request history with retention policies
SDKv0.3.0

SSE Streaming

  • •subscribe() SSE async iterator for real-time streaming
  • •describe() introspection for AI agents
MCPv0.1.0

Initial Release

  • •11 tools: create/list/get/update/delete endpoints, list/get requests, send/wait/replay, describe
  • •stdio transport via @modelcontextprotocol/sdk
  • •Setup CLI for Cursor, VS Code, Windsurf, Claude Desktop
Web Appv0.7.0

Rust Receiver & CLI TUI

  • •Rewrite webhook receiver from Go to Rust (Axum + sqlx + Tokio)
  • •Optimize database with stored procedures (capture_webhook())
  • •Guest live dashboard for unauthenticated users
  • •Strict quota enforcement for all endpoint types
CLIv0.5.0

TUI Mode

  • •Interactive TUI with menu, auth, endpoint listing, and request detail views
  • •Real-time SSE subscriptions in TUI
Web Appv0.6.0

Production Hardening

  • •Six phases of production hardening (abuse protection, CSP, rate limiting)
  • •Integration test suite (42 test cases)
  • •SEO metadata, sitemap improvements, crawler exclusions
CLIv0.4.0

Device Auth

  • •Browser-based device authentication flow
  • •whk update self-update with SHA256 verification
SDKv0.2.0

Matchers & Helpers

  • •Composable request matchers (matchMethod, matchHeader, matchBodyPath, matchAll, matchAny)
  • •Provider detection helpers (isStripeWebhook, isGitHubWebhook, etc.)
  • •parseJsonBody, parseFormBody, extractJsonField helpers
Web Appv0.5.0

Security & Docs

  • •Security hardening across backend, API routes, and CLI
  • •Floating navbar, sidebar, and docs improvements
CLIv0.3.0

Cosign Signing

  • •Cosign keyless signing for release binaries
SDKv0.1.0

Initial Release

  • •Endpoint CRUD (create, get, list, delete, update)
  • •Request list, waitFor with timeout and polling
  • •Replay captured requests to any URL
  • •Human-readable duration strings (30s, 5m)
Web Appv0.4.0

Public Pages

  • •Installation page with copy-paste commands
  • •Privacy policy and terms of service pages
  • •XML sitemap generation
CLIv0.2.0

Initial Release

  • •whk tunnel for forwarding webhooks to localhost
  • •whk listen for streaming requests to terminal
  • •whk create, list, delete for endpoint management
Web Appv0.3.0

Billing & Polish

  • •Polar.sh subscription management (free/pro tiers)
  • •Request batching and endpoint caching for high-throughput
  • •Dashboard UI improvements (empty states, layout fixes)
Web Appv0.2.0

CI/CD & Code Quality

  • •CI pipeline with lint, typecheck, build, and test stages
  • •Dependabot and CodeQL security scanning
  • •Input validation, CSP, and rate limiting
Web Appv0.1.0

Initial Release

  • •Dashboard with webhook capture and real-time inspection
  • •GitHub and Google OAuth authentication
  • •Basic endpoint CRUD and request viewer