Webhook Workbench
Open source · Webhook debugging in Go
A private, self-hosted workbench to capture, inspect, verify and safely replay webhooks — one dependency-free Go binary with the UI built in.
Problem
Debugging webhooks often means sending real payloads to a third-party inspection service.
Solution
A self-hosted Go binary that captures, verifies and safely replays webhooks, redacting secrets before storage.
Built in
Tests cover redaction, signature checks, replay and SSRF defences. Checksummed release binaries; live sandbox.
Overview
Webhook Workbench captures incoming webhooks on any channel and shows each request's decoded payload, redacted headers and a ready-to-run cURL command. It ships as a single Go binary built on the standard library alone, with the browser interface embedded, and listens only on localhost by default.
Signatures are verified against the exact captured body for GitHub, Stripe (with its five-minute receipt window) and generic HMAC-SHA-256 profiles; the secret is used once and never stored. Captured requests can be replayed to an endpoint of your choice, but conservatively: private, loopback and non-HTTP targets are rejected, DNS is re-checked on connect, redirects are limited, and authorization, cookie and hop-by-hop headers are stripped.
It keeps a bounded event history in a local JSON snapshot, preserves binary bodies as base64 and exposes a health probe. The Docker setup runs as a non-root user with dropped capabilities and a read-only root filesystem, and the tests cover redaction, signature verification, replay behaviour and SSRF defences.
What it does
- Captures any HTTP method at /inbox/{channel} and shows traffic live
- Verifies GitHub, Stripe and generic HMAC-SHA-256 signatures
- Replays captured requests safely, with SSRF protection
- Redacts secrets before storage; optional bearer-token auth
What's next
Hiring for a full-stack, Python or AI role — or need something like this built? Let's talk.
I'm available immediately — on-site or hybrid in Moscow, or remote; full-time or contract. I reply within 48 hours — faster on Telegram.