How to Test Webhooks Locally – Developer Guide

Webhooks deliver real-time events from services like Stripe, GitHub, and Slack to your application. But how do you test them when your server runs on localhost? This guide covers practical ways to receive, inspect, and verify webhooks during development.

1. The Problem: Webhooks Need a Public URL

Webhook providers send HTTP POST requests to a URL you configure. If your app runs on http://localhost:3000, external services cannot reach it. You need a tunnel or a hosted endpoint that forwards traffic to your machine.

2. Option A: ngrok Tunnel

ngrok creates a public URL that forwards to your local server:

# Install ngrok, then run:
ngrok http 3000

# Output: https://abc123.ngrok.io -> http://localhost:3000

# Use https://abc123.ngrok.io/webhooks/stripe as your Stripe webhook URL

Configure your webhook provider with the ngrok URL. Each request will hit your local app. Free tier gives you a random subdomain that changes on restart.

3. Option B: Online Webhook Tester

For quick inspection without running a server, use an online webhook tester. These tools give you a unique URL that logs incoming requests. You can:

• See headers, body, and query params
• Verify HMAC signatures (e.g., Stripe X-Stripe-Signature)
• Generate curl commands to replay requests

Try our free Webhook Tester — receive webhooks, verify HMAC-SHA256, and export curl for local debugging. All processing happens in your browser; no data is stored.

4. Implementation: Verify Webhook Signatures

Always verify the signature before processing. Use the raw request body (not parsed JSON), as parsing can alter bytes:

// Node.js: Stripe webhook verification
const stripe = require('stripe')(process.env.STRIPE_SECRET_KEY);
const sig = req.headers['stripe-signature'];

let event;
try {
  event = stripe.webhooks.constructEvent(req.body, sig, webhookSecret);
} catch (err) {
  return res.status(400).send(`Webhook Error: ${err.message}`);
}

5. Conclusion

Use ngrok for end-to-end testing against your local server, or an online webhook tester for quick inspection and HMAC verification. Always verify signatures in production. Try our Webhook Tester for instant, privacy-safe webhook debugging.