# Webhook Debugger & Relay Generate a unique webhook capture URL, inspect incoming requests, validate signatures, and replay payloads to a target endpoint > Canonical page: https://test.elysiatools.com/en/tools/webhook-debugger-relay - **Category:** Network - **Keywords:** webhook, debugger, relay, request bin, hmac, replay ## Overview The Webhook Debugger & Relay tool provides a unique capture URL to inspect, validate, and forward incoming HTTP requests. It allows developers to view payload details, verify HMAC signatures, and selectively replay webhooks to local or remote endpoints, making API integration testing seamless and secure. ## Inputs - **Relay Target URL** (text): https://api.example.com/webhooks/real-endpoint - **Signature Secret** (text): whsec_test_123 - **Signature Header** (text) - **Auto Replay Matching Requests** (checkbox) - **Method Filter** (select) - **Body Must Contain** (text): "event":"invoice.paid" - **Stored Request Limit** (number) ## When to use - Testing third-party API integrations like Stripe or GitHub before deploying to production. - Troubleshooting failed webhook deliveries by inspecting raw headers, payloads, and signatures. - Forwarding specific webhook events to a local development environment using conditional auto-replay. ## How it works - Generate a unique capture URL to receive incoming webhook requests. - Configure optional HMAC signature validation by providing your secret and header name. - Set method filters or body text requirements to isolate specific events. - Inspect captured payloads in the dashboard and manually or automatically relay them to your target URL. ## Use cases - Isolating and debugging specific payment events from Stripe or PayPal. - Validating GitHub push event signatures and forwarding them to a CI/CD pipeline. - Creating a temporary request bin to inspect undocumented API callbacks. ## Frequently asked questions ### What is a webhook capture URL? It is a temporary, unique endpoint generated by the tool to receive and log incoming HTTP requests from third-party services. ### How does signature validation work? By entering your signature secret and header name, the tool calculates the expected HMAC hash and compares it against the incoming request to verify authenticity. ### Can I automatically forward requests to my local server? Yes, by enabling the Auto Replay feature and setting a Relay Target URL, incoming requests that match your filters will be forwarded automatically. ### How many requests can I store? You can configure the stored request limit between 10 and 200 requests. Older requests are overwritten once the limit is reached. ### Can I filter which webhooks are captured or replayed? Yes, you can filter incoming requests by HTTP method (like POST or PUT) and specify text that must be present in the payload body. ## Related tools - [Tailwind Color Palette Sync](https://test.elysiatools.com/en/tools/tailwind-color-palette-sync): Generate theme.extend.colors for tailwind.config.ts from HEX colors, with WCAG contrast levels and optional dark mode. - [AI Domain Name Idea Generator](https://test.elysiatools.com/en/tools/ai-domain-name-idea-generator): Generate up to 10 creative domain names with AI and filter out already-registered ones via DNS + RDAP. - [NB-IoT LTE-M Cat-M1 CoAP LwM2M Cellular IoT Packet Analyzer](https://test.elysiatools.com/en/tools/nb-iot-lte-m-cat-m1-coap-lwm2m-cellular-iot-packet-analyzer): Decode hex captures from cellular IoT devices: CoAP headers/options (block-wise, Observe), LwM2M TLV object trees with registry names, SMS-DELIVER UDH port addressing unwrapping CoAP-over-SMS, link-format registrations and DTLS record summaries. - [DNSSEC Chain & RDAP Trust Auditor](https://test.elysiatools.com/en/tools/whois-rdap-dnssec-chain-validator-and-iana-bootstrap-trust-auditor): Audit a domain end to end: IANA RDAP bootstrap referral, registry/registrar WHOIS data, and the DNSSEC chain of trust from the root KSK through the TLD DS to the apex DNSKEY — with DS digest verification and RRSIG expiry flags. - [Geocache Letterbox Munzee Stage-Cache Puzzle-Hunt Coordinate Validator](https://test.elysiatools.com/en/tools/geocache-letterbox-munzee-stage-cache-puzzle-hunt-coordinate-validator): Validate GC-codes (base-31 with offset, or hex era), place caches on the 81-cell D/T Fizzy grid, chain multi-stage bearing projections into WGS84 waypoints, and cross-check puzzle finals against checker coordinates. - [HTTP Link Header RFC 8288 Parser and Pagination Crawler Preview](https://test.elysiatools.com/en/tools/http-link-header-rfc8288-parser-and-pagination-crawler-preview): Parse RFC 8288 Link headers with the spec appendix-B algorithm, resolve relative URI-references against a base URL, classify rel types against the IANA registry, validate preload/prefetch hints, and simulate how a rel="next" pagination crawler walks your responses — including cycle detection. - [JWK Generator & Parser](https://test.elysiatools.com/en/tools/jwk-generator): Generate JSON Web Keys (JWK) for RSA, EC (P-256/P-384/P-521/secp256k1), and OKP (Ed25519/Ed448/X25519/X448), or parse an existing JWK to inspect its parameters, thumbprint, and metadata - [OAuth 2.0 / OIDC Authorization Code with PKCE Flow Visualizer](https://test.elysiatools.com/en/tools/oauth-oidc-authorization-code-pkce-flow-visualizer): Simulate the Authorization Code flow with PKCE end to end: verifier/challenge generation, authorization URL, token exchange, ID Token validation checklist and an interception-attack demo. ## Samples - [Web Image Processing Python Samples](https://test.elysiatools.com/en/samples/web-image-processing-python): Web Python image processing examples using PIL/Pillow including reading, saving, resizing, and format conversion - [Android Image Processing Java Samples](https://test.elysiatools.com/en/samples/android-image-processing-java): Android Java image processing examples including reading/saving images, scaling, and format conversion - [Android Image Processing Kotlin Samples](https://test.elysiatools.com/en/samples/android-image-processing-kotlin): Android Kotlin image processing examples including reading/saving images, scaling, and format conversion - [Web Image Processing Rust Samples](https://test.elysiatools.com/en/samples/web-image-processing-rust): Web Rust image processing examples including image read/save, scaling, and format conversion ## Related content - [Authorized Webhook Capture and Endpoint Trust Checks](https://test.elysiatools.com/en/hubs/webhook-delivery-and-endpoint-trust): Capture and replay controlled webhook requests, inspect delivery evidence, and check the receiver HTTPS certificate without treating a valid certificate as proof of business trust. - [API Request Format, Replay Preparation, and Debugging Tools](https://test.elysiatools.com/en/hubs/api-request-replay-and-debugging): Check request structure, prepare a local replay, compare responses, and debug API clues. These tools analyze or generate locally and do not replace real authentication or server tests. - [Network Triage, Packet Inspection, and Endpoint Debugging](https://test.elysiatools.com/en/hubs/network-triage-debugging): Inspect captures, replay webhooks, validate addresses and CIDR ranges, check DNS, WHOIS, hosts files, TLS, and user agents, then record a focused network diagnosis. - [Observability Debugging from Logs, Traces, Webhooks, and JSON Payloads](https://test.elysiatools.com/en/hubs/observability-debugging): Parse logs, decode traces, inspect webhook/API evidence, explore JSON payloads, and extract recurring patterns before writing an incident-ready debugging note.