How to test webhooks without a server

Start with the request, not a receiver

A webhook is an HTTP request sent when something happens in another system. Before writing your handler, it helps to see the exact method, headers, query parameters, and body that the sender uses.

A temporary inbox gives that request a destination. Use a provider’s sandbox and synthetic data: an inbox stores the received body and query parameters, so a real customer payload can contain more information than you expect.

Create an inbox with the right access

Open the Webhook inbox tool and create an inbox. New inboxes default to private. A private sender must supply the separate access token in the X-Access-Token header.

If a provider cannot add that header, explicitly choose public receiver access. Public means anyone who knows the endpoint can send a request. Viewing captured history still requires your management credential or workspace membership.

curl -X POST 'https://socket.help/api/inboxes?visibility=public'

Send a small, recognizable event

Save the returned webhookUrl, ID, expiry, and inspectionToken. Replace INBOX_ID below with the returned ID. A distinctive event ID makes retries and duplicates easy to spot.

curl -X POST https://socket.help/hooks/INBOX_ID \
  -H 'Content-Type: application/json' \
  -d '{"event":"order.created","id":"test-order-001"}'

Inspect what actually arrived

Select the captured request in the browser or fetch history over HTTP. Compare the content type with the body, check repeated query parameters, and look for multiple deliveries of the same event.

Use the HTTP method filter to separate callback deliveries from probes. Search all fields to find an event ID, or choose Path, Text body, Headers or Query to narrow the match. Search is case-insensitive and runs on the history already loaded in your browser; binary bodies are not searched as if they were text. A matching count helps distinguish an empty inbox from a filter that hides its requests.

Sensitive header names are redacted before storage. If you need to test signature verification, use your own handler and test secret. An inbox inspection does not verify that a webhook signature is valid.

curl https://socket.help/api/inboxes/INBOX_ID/requests \
  -H "Authorization: Bearer $INBOX_INSPECTION_TOKEN"

If the callback is missing

Check the provider’s delivery log first. Confirm the full endpoint, receiver visibility, required access header, request size, and expiry. Anonymous inboxes accept up to 100 requests or 1 MiB of stored history; individual bodies are limited to 100 KiB.

Private access failures, full history, expired resources, and rate limits can all prevent capture. Do not repeatedly retry without checking the response status. Delete the inbox when the test is finished; otherwise its lifetime starts at one hour.