About this tool
Testing a webhook handler usually means waiting for the platform to send you an event — or clicking resend in a dashboard and hoping the payload looks like the one you need. Webhook Replay Builder flips that around: it lets you craft the exact POST request a provider would send, complete with a valid signature, so you can replay it against your local development server as many times as you like. Paste the JSON payload, choose the platform preset — Meta, Shopify or Stripe — and enter the signing secret your endpoint expects. The tool computes the correct HMAC-SHA256 locally with the Web Crypto API: the sha256-prefixed hex used in Meta's X-Hub-Signature-256 header, the base64 digest Shopify puts in X-Shopify-Hmac-Sha256, or Stripe's t-timestamp-comma-v1 scheme that signs the timestamp and body together. It then assembles a ready-to-paste curl command with the right headers and your target URL, shell-escaped and everything, so a single paste replays the delivery against localhost. Because the secret and payload never leave your browser, you can safely build replay requests that match production signatures. Pair it with a tunnel like ngrok and you can replay against any environment in seconds.
How to use Webhook Replay Builder
- Paste the JSON payload you want your endpoint to receive — it is sent byte-for-byte as the request body.
- Choose the platform preset (Meta, Shopify or Stripe) and enter the signing secret your endpoint verifies against.
- Set the target URL, typically your local server or an ngrok tunnel.
- Copy the generated curl command and run it — your endpoint receives a request with a valid signature header.
Frequently asked questions
Why do the signatures need my real secret?
Webhook signatures are HMACs of the body keyed with the endpoint's secret. Only the real secret produces a signature your verification code will accept — which is also why everything runs locally and nothing is uploaded.
What is different about Stripe's signature?
Stripe signs the string timestamp-dot-payload and sends t and v1 values in the Stripe-Signature header. The tool mints a fresh timestamp on every build, so replay-tolerance checks pass.
Can I replay against production?
You can point the URL anywhere, but prefer a staging or local endpoint — replays run your full handler logic, including side effects like sending emails or writing to the database.
My payload is not valid JSON — can I still build a request?
Yes. The tool warns you because most platforms send JSON, but it signs and sends the exact bytes you paste, which is useful when testing how your handler treats malformed bodies.