Capture, inspect and safely replay webhooks on your own server.
Self-hosted request capture for webhook development and debugging, with header redaction and SSRF-safe replay.
Create a unique URL for each integration and point any provider at it.
Inspect method, path, query, headers, body, source IP and timestamp.
Authorization, Cookie and API-key headers are redacted automatically.
Replay a captured request to a public URL, with SSRF protection against internal addresses.
Integrations break in the space between two systems. Webhook Inspector gives each integration a private endpoint so you can see exactly what a provider sent, compare deliveries and replay a request while you fix your handler.
The complete TypeScript source (Express, EJS views, SQLite), Docker Compose files, a protected admin dashboard, environment examples and setup documentation.
Sample data only. Nothing you do there affects anyone else.
Anything else? Email [email protected].
Webhook payloads often contain customer data and signatures. A self-hosted inspector keeps them on your infrastructure and lets you control retention.
No. Replay is limited to public URLs and blocks private and loopback addresses.
Docker Compose, or Node.js 20+ directly. Data is stored in SQLite.
Aikido Security reveals that leaked GitLab issue email addresses can be used to push code to main branches and run CI jobs, bypassing IP restrictions and two-factor authentication.
Know when scheduled jobs stop running.
Live demoEncrypted file sharing with passwords, expiry and download limits.
Live demoTurn messy spreadsheets into clean, validated data.
Live demoCatch expiring certificates and domains before your visitors do.
Live demo