Skip to content

Dashboard Test Webhooks

Use the dashboard Send button to fire manual requests or realistic provider webhook templates with correct signatures. Verify your handler end-to-end without deploying or configuring an external service.

Updated May 2026

Open the sender

  1. Open an endpoint in the dashboard.
  2. Click Send in the URL bar.
  3. Select either manual mode or a provider template mode.
  4. Send the request and inspect the captured result in the request list.

Manual mode

Manual mode lets you choose method, path, headers, and body. Use this when you need a custom request shape or when you are debugging a non-standard sender.

Method: POST
Path: /stripe/webhook
Headers:
  Content-Type: application/json
Body:
  {"event":"test.manual"}

Provider template mode

Provider templates generate realistic payload structure and signature headers so you can test verification logic, not just transport. Captured template requests are also auto-detected in the request list, so you can immediately see the provider icon and event/topic badge.

ProviderPresetsContent-TypeSignature header
Stripepayment_intent.succeeded, checkout.session.completed, invoice.paidapplication/jsonstripe-signature (HMAC SHA-256 over timestamp.payload)
GitHubpush, pull_request.opened, pingapplication/jsonx-hub-signature-256 (HMAC SHA-256 over raw body)
Shopifyorders/create, orders/paid, products/update, app/uninstalledapplication/jsonx-shopify-hmac-sha256 (Base64 HMAC SHA-256 over raw body)
Twiliomessaging.inbound, messaging.status_callback, voice.incoming_callapplication/x-www-form-urlencodedx-twilio-signature (Base64 HMAC SHA-1 over URL + sorted params)
Slackevent_callback, slash_command, url_verificationapplication/jsonx-slack-signature (HMAC SHA-256 over v0:timestamp:body)
Paddletransaction.completed, subscription.created, subscription.updatedapplication/jsonpaddle-signature (HMAC SHA-256 over timestamp:body)
Linearissue.create, issue.update, comment.createapplication/jsonlinear-signature (HMAC SHA-256 over raw body)
SendGriddelivered, open, bounce, spam_reportapplication/jsonNone (unsigned)
Clerkuser.created, user.updated, user.deleted, session.createdapplication/jsonwebhook-signature (Standard Webhooks / Svix signing)
Discordinteraction_create, message_component, pingapplication/jsonNone (unsigned template; Ed25519 verification available separately)
Verceldeployment.created, deployment.succeeded, deployment.errorapplication/jsonx-vercel-signature (HMAC SHA-1 over raw body)
GitLabpush, merge_requestapplication/jsonx-gitlab-token (raw token comparison)
Typeformform_response, partial_response, paymentapplication/jsontypeform-signature (sha256= Base64 HMAC SHA-256 over raw body)
Standard WebhooksNo presets — user-provided bodyapplication/jsonwebhook-id + webhook-timestamp + webhook-signature (v1, Base64 HMAC SHA-256 over msgId.timestamp.body)
Metawhatsapp.messages, page.messages, instagram.commentsapplication/jsonx-hub-signature-256 (sha256= HMAC SHA-256 over raw body, keyed by app secret)
Lemon Squeezyorder_created, subscription_created, subscription_payment_successapplication/jsonx-signature (hex HMAC SHA-256 over raw body)
Coinbase Commercecharge:confirmed, charge:failed, charge:pendingapplication/jsonx-cc-webhook-signature (hex HMAC SHA-256 over raw body)
Razorpaypayment.captured, payment.failed, order.paidapplication/jsonx-razorpay-signature (hex HMAC SHA-256 over raw body)
Cal.comBOOKING_CREATED, BOOKING_CANCELLED, BOOKING_RESCHEDULEDapplication/jsonx-cal-signature-256 (hex HMAC SHA-256 over raw body)
Intercomconversation.user.created, conversation.admin.replied, contact.createdapplication/jsonx-hub-signature (sha1= hex HMAC SHA-1 over raw body, keyed by client secret)
Telegrammessage, callback_query, edited_messageapplication/jsonx-telegram-bot-api-secret-token (raw token comparison)
Squarepayment.created, payment.updated, refund.createdapplication/jsonx-square-hmacsha256-signature (Base64 HMAC SHA-256 over notification URL + raw body)
HubSpotcontact.creation, contact.propertyChange, deal.creationapplication/jsonx-hubspot-signature-v3 (Base64 HMAC SHA-256 over method + URI + body + timestamp)
Mailgundelivered, failed, openedapplication/jsonNone — signs body fields signature.{timestamp,token,signature} (hex HMAC SHA-256)
Calendlyinvitee.created, invitee.canceled, routing_form_submission.createdapplication/jsoncalendly-webhook-signature (t=...,v1=... hex HMAC SHA-256 over timestamp.body)
Muxvideo.asset.created, video.asset.ready, video.upload.asset_createdapplication/jsonmux-signature (t=...,v1=... hex HMAC SHA-256 over timestamp.body)
Sentryissue.created, issue.resolved, error.createdapplication/jsonsentry-hook-signature (hex HMAC SHA-256 over raw body)
Bitbucketrepo:push, pullrequest:created, pullrequest:fulfilledapplication/jsonx-hub-signature (sha256= hex HMAC SHA-256 over raw body)

Send the same template from code

Use the SDK when you want the same provider-shaped request in tests:

import { WebhooksCC, matchHeader } from "@webhooks-cc/sdk";
 
const client = new WebhooksCC({ apiKey: process.env.WHK_API_KEY! });
const endpoint = await client.endpoints.create({ name: "typeform-demo" });
 
await client.endpoints.sendTemplate(endpoint.slug, {
  provider: "typeform",
  template: "form_response",
  secret: "typeform_test_secret",
});
 
const request = await client.requests.waitFor(endpoint.slug, {
  timeout: "10s",
  match: matchHeader("typeform-signature"),
});
 
console.log(request.headers["typeform-signature"]);

Mock webhook secret and event override

Enter your provider signing secret in Mock webhook secret. The sender signs the generated payload with that secret and sets the provider-specific signature header.

Leave Event/topic override empty to use the preset default. Use override only when you need to test a specific event name.

Twilio signatures are computed from URL + sorted form params. If you override a Twilio body as a string, provide URL-encoded key/value pairs (not raw JSON).

Verification checklist

  • Verify your server reads the raw request body before parsing JSON.
  • Verify signature checks fail if you change the secret.
  • Verify your handler branches on provider event/topic correctly.
  • Verify Twilio handlers parse form-encoded payloads.