New
API Request Builder
Build HTTP requests with headers, auth and a body, send them from your browser, and copy them as cURL, fetch or Python.
How it works
Webhook Tester
Create a private URL, point a service at it, and see every request it sends as it arrives: method, path, headers, query and a formatted body. Then check the signature with your secret, without it leaving your browser.
Get a private URL that records every request sent to it
Point Stripe, GitHub, Shopify or your own app at it and watch requests arrive here live. URLs last 24 hours.
Send a test request
Requests
Live
Waiting for the first request…
- 01
Click Create webhook URL and copy the address.
- 02
Paste it into the sender's webhook settings, or send a test request from this page or with cURL.
- 03
Watch requests appear, and click one to see its body, headers and query string.
- 04
Open Verify signature, enter your signing secret, and check the request is genuine.
About this tool
See exactly what a webhook sends
Webhooks are hard to debug because they arrive at your server, not your screen. Before writing a handler, it helps to see a real request: which headers carry the event type and signature, how the body is shaped, and whether the sender retries. This tester gives you a temporary URL that records everything sent to it, so you can trigger a test event from Stripe, GitHub, Shopify or your own app and inspect it immediately.
Requests are stored on Instant.tools servers (Cloudflare) for up to 24 hours, then deleted automatically, and each URL keeps its latest 100 requests. The URL is long and random, so only people you share it with can send to it, and only you can see what arrived. Don't send real customer data or production secrets to a testing URL; use the sender's test mode where it has one.
Live capture
Any method and any path under your URL, shown within seconds with method, headers, query and body.
Readable payloads
JSON pretty-printed, form bodies decoded, binary bodies kept as base64.
Signature check
Verify GitHub, Stripe, Shopify, Slack or custom HMAC-SHA256 signatures in your browser.
Replay as cURL
Copy any captured request as a cURL command to send it to your own endpoint.
FAQ
Frequently asked questions
How long do captured requests last?
Each URL lasts 24 hours and keeps its latest 100 requests. After that the URL stops accepting requests and everything stored for it is deleted automatically.
What does the sender get back?
A 200 response with a short JSON body, so senders treat the delivery as successful and don't retry. Bodies over 256 KB are cut, and requests over 2 MB are refused.
Is my signing secret sent anywhere?
No. Signatures are computed in your browser with the Web Crypto API. The secret is never sent to our servers or saved.
Can anyone see my requests?
Only someone who knows your URL can send to it, and viewing requests works only from the Instant.tools site with the URL's random ID. Treat the URL like a password and use test data.
Is there a rate limit?
Each URL accepts up to 30 requests a minute. That's plenty for testing; for load testing, use your own infrastructure.
Missing something?
Tell us the tool you wish existed.
Describe the job and the file types involved. The most requested tools get built first.