{ "markdown": "

\n \"webhook.co\"\n

\n\n

webhook.co

\n\n

\n A free, permanent, signed webhook URL you can inspect and replay to localhost — from the CLI, API, dashboard, or MCP.\n

\n\n

\n \"License:\n \"CLI\n \"CI\"\n \"Docs\"\n

\n\n`webhook.co` captures the webhooks other services send you, so you can see exactly what arrived,\ncheck the signature, and replay it to your local dev server without redeploying. The same operations\nrun from the CLI, the REST API, the web dashboard, and an MCP server.\n\n- **Receive** — a stable, signed URL on a dedicated apex (`https://wbhk.my/`). No expiring\n tunnels.\n- **Inspect** — every request, headers and body, with a clear signature result.\n- **Replay to localhost** — forward any captured event to `http://localhost:3000` with one command.\n- **Deliver** — send events on to your own destinations, in order, with retries.\n\n**Want to see it work first?** Open **[webhook.co/play](https://webhook.co/play)** — send a webhook,\nwatch it land. No signup, nothing to install.\n\nOpen source · Apache-2.0 · private by default.\n\n## Try it in 60 seconds\n\nSign in, create an endpoint, forward its webhooks to your machine, and send it a test request. No\ninstall needed — this uses `npx` (Node 22+):\n\n```sh\n# 1. sign in — opens your browser (GitHub or Google) and creates your free account\nnpx @webhook-co/cli login\n\n# 2. create an endpoint — it prints an id and your permanent, signed ingest URL:\nnpx @webhook-co/cli endpoints create orders\n# id d7e4f8a1-3b60-4c2e-9f15-0a8c6b2e1d94\n# ingest url https://wbhk.my/whep_8QmZ4tN1p…\n\n# 3. forward that endpoint's events to your local server (leave this running)\nnpx @webhook-co/cli listen d7e4f8a1-3b60-4c2e-9f15-0a8c6b2e1d94 --forward http://localhost:3000\n\n# 4. in another terminal, send it a test request — or point Stripe, GitHub, Shopify, … at the URL\ncurl -X POST https://wbhk.my/whep_8QmZ4tN1p… -d '{\"hello\":\"webhook.co\"}'\n```\n\nWith `--forward`, each captured event prints one line as it lands on your local server — the event\nid, the target, the status it returned, and how long it took:\n\n```text\ncaught up — now tailing live events\nforwarded 019f8b88-55f0-7534-9ae9-f9fcfd07758c → http://localhost:3000 · 200 · 8ms\nforwarded 019f8b88-6121-72e7-b640-56ecb2b2ffb2 → http://localhost:3000 · 200 · 3ms\nforwarded 019f8b88-6c40-7bdf-a81f-7290b2752992 → http://localhost:3000 · 200 · 2ms\n```\n\nDrop `--forward` and `wbhk listen` opens a live view of what's arriving instead — one row per event,\nwith the provider it came from and whether its signature checked out:\n\n

\n \"wbhk\n

\n\n`--forward` targets must be a full loopback URL (`http://localhost:3000`,\n`http://127.0.0.1:8080/webhooks`). Replay a past event with\n`wbhk replay --forward http://localhost:3000`.\n\nPrefer a permanent install? Pick one:\n\n```sh\nbrew install webhook-co/tap/wbhk # Homebrew (macOS / Linux)\nnpm install -g @webhook-co/cli # npm — installs the wbhk command\ncurl -fsSL https://get.webhook.co | sh # standalone binary, no Node required\n```\n\nFull walkthrough: **[docs.webhook.co/quickstart](https://docs.webhook.co/quickstart)**.\n\n## What you get\n\n**A permanent, signed URL that captures first.** Every request is written to durable storage the\ninstant it lands — before verification or dedup run — so a bad signature, an unknown provider, or a\ndownstream outage only changes what happens *next*, never whether you have the event. The ingest URL\nis a sealed credential you can re-read on demand and rotate in place, not a secret shown once.\n\n**Verification for 144 providers, built in.** One open registry\n([`packages/webhooks-spec`](packages/webhooks-spec)) covers Stripe, GitHub, Shopify, Slack, Twilio,\nSquare, PayPal, Discord, Clerk, Supabase, and [many more](https://docs.webhook.co/providers/directory).\nEvery event is sorted into one of four states — **verified** (a cryptographic signature checked),\n**authenticated** (source proven by a shared secret, no payload signature), **failed** (a signature\nwas checked and rejected), or **unattempted** — and a failure names the likely cause instead of\nstopping at \"no signatures found.\" Signing and verification follow the\n[Standard Webhooks](https://www.standardwebhooks.com/) spec, for both receive and send.\n\nThat registry is also a standalone library, usable without an account — or this product:\n\n```sh\nnpm install @webhook-co/webhooks-spec\n```\n\n```js\nimport { getAdapterForScheme } from \"@webhook-co/webhooks-spec\";\n\nconst adapter = getAdapterForScheme(\"github\"); // name the provider — it's your endpoint\nconst result = await adapter.verify({ rawBody, headers, secrets: [process.env.WEBHOOK_SECRET] });\n// result.ok, or result.reason.code — WRONG_SECRET vs RAW_BODY_MODIFIED vs TIMESTAMP_TOO_OLD\n```\n\nSee [`packages/webhooks-spec`](packages/webhooks-spec) for the full API. A provider it doesn't cover\nyet is usually one config row — that's a\n[good first issue](https://github.com/webhook-co/webhook/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22).\n\n**Reliable outbound delivery.** Forward captured events to your own destinations with strict FIFO\nordering (one Durable Object per destination), at-least-once delivery, retries on exponential backoff,\nand dead-lettering once a destination exhausts its retries. Deliveries carry a fresh signature only\nfor events `webhook.co` verified or authenticated; anything it couldn't vouch for is relayed unsigned.\nOptional per-endpoint deduplication collapses repeats by Standard-Webhooks id, provider event id, a\ncontent hash, or JSON fields you choose.\n\n**Replay on demand.** Re-send any captured event still within your retention window — to localhost or\nto a registered destination — to fix a handler or recover from an outage, without asking the provider\nto send it again.\n\n**Private by default, with the controls built in.** Nothing is public unless you make it so. Tenant\nisolation is enforced by Postgres row-level security; secrets are envelope-encrypted under a KMS;\ntraffic is encrypted in transit and at rest; and privileged actions land in an append-only,\nhash-chained audit log with a verifier (`wbhk audit verify`) that proves the chain hasn't been\naltered.\n\n**One capability contract, four surfaces.** Every capability is defined once and bound identically to\nthe CLI, the REST API, the web dashboard, and the MCP server. A parity gate fails the build if a\nsurface forgets one — so the surfaces don't drift.\n\n## Built for agents\n\nAn agent can act on inbound webhooks without you writing the plumbing. The\n[MCP server](https://docs.webhook.co/mcp/overview) at `mcp.webhook.co` is a first-class surface\n(remote HTTP on Cloudflare Workers, OAuth-authorized), and `triggers.wait` is the primitive: an agent\nregisters a trigger on an endpoint and drains new events since its last cursor — at-least-once, in\ncapture order per endpoint, held durably while the agent is offline, with the verified payload inline\n(up to 64 KiB). It is a short poll the agent drives, not a push: MCP has no native inbound trigger,\nso nothing calls your agent — it calls us, and the durable log means an offline agent misses nothing.\n\nEgress-configuring capabilities (registering replay destinations and subscriptions) are deliberately\nkept off MCP, and localhost replay stays CLI-only — a confused-deputy and SSRF precaution, not a\nmissing feature.\n\n## SDKs and CLI\n\nThree official client SDKs, generated from the same OpenAPI contract as the API, plus the `wbhk` CLI.\nEach SDK ships bearer auth, bounded retries with jitter, cursor pagination, idempotency, and secret\nredaction.\n\n| Language | Install | Import |\n| --- | --- | --- |\n| **TypeScript** | `npm install @webhook-co/sdk` | `import { WebhookClient } from \"@webhook-co/sdk\"` |\n| **Python** | `pip install webhook-co` | `from webhook_co import WebhookClient` |\n| **Go** | `go get github.com/webhook-co/webhook-go` | `import webhook \"github.com/webhook-co/webhook-go\"` |\n| **CLI** | `brew install webhook-co/tap/wbhk` | the `wbhk` command |\n\nThe TypeScript SDK runs anywhere `fetch` does (Node 18+, browsers, Deno, Bun, Workers). The Python\nSDK needs Python 3.10+. The Go SDK needs Go 1.22+ and has zero third-party dependencies — standard\nlibrary only — and lives in its own repository,\n[`webhook-co/webhook-go`](https://github.com/webhook-co/webhook-go).\n\nThe REST API lives at `https://api.webhook.co/v1`, authenticated with a `whk_` bearer key, and is\ndescribed by a machine-readable OpenAPI 3.1 document at\n[`api.webhook.co/openapi.json`](https://api.webhook.co/openapi.json) — the one source that also\ngenerates the SDKs and the docs.\n\nDistribution is independently verifiable: npm packages are published with provenance\n(`npm audit signatures`), and the standalone CLI binaries carry sigstore-signed SLSA build provenance\n(`gh attestation verify wbhk-- --repo webhook-co/webhook`).\n\n## Pricing\n\n`webhook.co` is free to start: a permanent signed URL, inspect, and replay, with **5,000 events to\nspend once** — a real trial allowance that never resets. Paid plans (Pro, Scale, Enterprise) price on\na **single dimension — events** — with a soft cap that **pauses capture rather than surprising you\nwith a bill**. The whole receive → verify → deliver → replay pipeline, outbound delivery included, is\non every plan; plans differ by event volume and retention window. Full numbers:\n**[webhook.co/pricing](https://webhook.co/pricing)**.\n\n## How it's built\n\n`webhook.co` is a Turborepo + pnpm-workspaces monorepo. The core engine is TypeScript on Cloudflare\nWorkers; ordering and isolation come from one Durable Object per destination, with Durable Object\nAlarms driving retry scheduling; metadata and dedup live in Neon Postgres via Hyperdrive; and payloads\nare stored content-addressed in R2. Ingestion runs on a **separate registrable apex, `wbhk.my`** —\ncookieless, no CORS, path-token routed, with a `404` for unknown tokens — deliberately isolated from\nthe primary application domain.\n\n```\napps/\n api/ REST API (api.webhook.co)\n engine/ capture / verify / deliver — Workers + Durable Objects\n web/ dashboard (app.webhook.co)\n www/ marketing site (webhook.co)\n docs/ documentation (docs.webhook.co)\n mcp/ MCP server (mcp.webhook.co)\n auth/ identity / OAuth issuer (auth.webhook.co)\n play/ no-signup playground (webhook.co/play)\n get/ CLI install shim (get.webhook.co)\n telemetry/ anonymous, opt-out CLI telemetry\npackages/\n cli/ the wbhk CLI + listen / replay-to-localhost\n webhooks-spec/ Standard Webhooks signing + the 144-provider registry\n contract/ the capability contract + cross-surface parity gate\n sdk-ts/ the TypeScript SDK (@webhook-co/sdk)\n shared/ shared types, the plan catalog, utilities\n ui/ shared UI components\n portal-sdk/ embeddable portal SDK\nee/ proprietary, license-fenced (excluded from self-host builds)\ninfra/ infrastructure as code\nsdks/python/ the Python SDK (webhook-co)\n```\n\n[`AGENTS.md`](AGENTS.md) is the constitution — the shared context, conventions, and non-negotiables\nevery contributor and coding agent follows.\n\n## Open core\n\nThe core — the delivery/ingestion engine, the CLI and replay client, the MCP server, the SDKs, and\nthe Standard-Webhooks signing implementation — is **Apache-2.0**. Proprietary features live behind the\n[`ee/`](ee) fence and are excluded from self-host builds; open-core code never imports from `ee/`.\nOpen source exists here for transparency and trust; an open, shared webhook interop standard — not a\nrestrictive license — is the point.\n\n**If this is useful to you, a ⭐ helps.** It is the signal other developers use to decide whether a\nwebhook tool is worth their afternoon, and it is the only one we can't write ourselves.\n\n## Contributing\n\nSetup is `pnpm install` (Node 24, pinned in [`.nvmrc`](.nvmrc); pnpm via `corepack enable`). The\neveryday loop:\n\n```sh\npnpm lint # ESLint (incl. security rules) + repo guards\npnpm format # Prettier\npnpm typecheck # tsc across the workspace\npnpm test # Vitest\npnpm build # turbo build\n```\n\nChanges land via pull request to `main` behind required CI checks and a review. See\n[`CONTRIBUTING.md`](CONTRIBUTING.md) for the full setup, the check gate, and the merge model. Issues\nand discussions are welcome, and everyone taking part is held to the\n[Code of Conduct](CODE_OF_CONDUCT.md).\n\nLooking for somewhere to start? The\n[`good first issue`](https://github.com/webhook-co/webhook/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22)\nlabel is where we park the small, self-contained ones.\n\n## Security\n\nPlease report vulnerabilities privately — see [`SECURITY.md`](SECURITY.md). Don't open a public issue\nfor a security report.\n\n## License\n\n[Apache-2.0](LICENSE) for the open core. See [`NOTICE`](NOTICE) for attribution and the\n[`ee/`](ee) directory for the separately-licensed proprietary components.\n\n---\n\nDocs: [docs.webhook.co](https://docs.webhook.co) · Playground:\n[webhook.co/play](https://webhook.co/play) · Changelog:\n[docs.webhook.co/changelog](https://docs.webhook.co/changelog)\n", "bytes": 14273, "sha": "78beb8ad97997fe15d610a52df4ecc411eaaaf11f8558a85e0ba05eee72454c5", "repo_slug": "webhook-co/webhook", "fonte": "repo", "truncated": false, "api": "https://agentalog.com/api/listings/mcp_co_webhook_webhook_7ea34458/readme" }