Free Webhook Simulator

The simulator sends one POST from a server-side route to the URL you give it, waits up to ten seconds, and reports the status code, the round trip time and the first 20,000 characters of your response. That is a reachability test and a body-shape test, and both are worth running before an integration review. It carries no signature header and makes no second attempt, so the three behaviors that break real consumers stay untested here: verifying the sender, surviving a duplicate, and handling events that arrive out of order.

Signature verification is the one to build first. A production sender signs the raw body with a shared secret and puts the digest in a header with a timestamp; the receiver recomputes the digest over the bytes it received, compares in constant time, and rejects anything older than a few minutes so a captured request cannot be replayed later. The detail that catches people is the word raw. A framework that parses JSON and re-serializes it changes whitespace and key order, the digest stops matching, and the endpoint that worked against this simulator fails against the sender.

Duplicates are the failure that reaches production. Delivery is at least once, so a receiver that times out after doing its work will be sent the same event again, and the second copy is indistinguishable from the first apart from an id. A consumer that credits a balance on receipt credits it twice. The fix is to record the event id before acting, treat a repeat as work already done, and return 200 to it, keeping non-2xx replies for events you want redelivered. Reply quickly and process afterwards; a sender that times out at ten seconds treats a slow success as a failure.