Build and send webhook requests online. Test endpoints with realistic payloads and inspect responses.
curl -X POST 'https://example.com/webhook' \
-H 'Content-Type: application/json' \
-d '{
}'Webhook Tester lets you send real HTTP requests to any webhook endpoint and inspect exactly what comes back. You configure the method (GET, POST, PUT, PATCH, DELETE), the target URL, custom headers such as Content-Type or Authorization, and a request body in JSON, form-urlencoded, or raw text, then fire the request and read the full response including status code, response headers, and body.
It is built for backend developers, integration engineers, and QA testers who need to confirm that a webhook receiver behaves correctly, that a payload is accepted, or that an outbound integration is hitting the right URL with the right signature and headers, without writing a curl command or a throwaway script.
A webhook is just an HTTP callback: one system sends an HTTP request (usually a POST with a JSON body) to a URL you control when an event happens. This tool acts as the sender. It assembles a standard HTTP request from your inputs, the request line (method and URL), the header block, and the body, then transmits it and captures the raw response so you can verify the receiver's behavior.
The Content-Type header is critical because it tells the receiver how to parse the body. JSON payloads use application/json, HTML form posts use application/x-www-form-urlencoded, and file-style posts use multipart/form-data. Many providers also require a signature header, for example an HMAC-SHA256 hash of the body sent as X-Hub-Signature-256, so the receiver can confirm the request is authentic. Use the headers section to replicate those.
Because requests originate from your browser, the destination endpoint must permit cross-origin requests (CORS) for the full response body to be readable. Endpoints that do not return the appropriate Access-Control-Allow-Origin header may block the response even though the request was delivered. For server-to-server webhooks that reject browser origins, a server-side tester or a request-capture URL is the reliable approach.
Yes, it is completely free with no sign-up. The request is built and sent directly from your browser to the endpoint you specify, so your URLs, headers, and payloads are not stored on our servers.
You can send GET, POST, PUT, PATCH, and DELETE requests. POST is the most common for webhooks since most providers deliver event payloads as a POST with a JSON body.
The request may reach the endpoint, but browsers block reading the response unless the server returns an Access-Control-Allow-Origin header that permits your origin. This is a browser security policy, not a failure of the endpoint itself.
Yes. Add any custom header in the headers section, including Authorization: Bearer tokens, Basic auth, API keys, or signature headers like X-Webhook-Signature and X-Hub-Signature-256.
Select the JSON body type and paste valid JSON. The tool sets Content-Type to application/json automatically so the receiver parses the body as JSON rather than plain text.
It shows the HTTP status code, the response headers, the response time, and the full response body returned by the endpoint, so you can confirm whether your payload was accepted or rejected.
You can, as long as you generate the signature yourself and paste it into the matching header. Compute the HMAC over the exact body you send, since any difference in the body will invalidate the signature.